Android apps are heavily containerized, so unless you gave the app a filesystem permission, it can't write to it. By default they can only use their 'own' data

Android apps are heavily containerized, so unless you gave the app a filesystem permission, it can't write to it. By default they can only use their 'own' data storage (which is represented as /data/data/$APPNAME on the filesystem). But even if you allow filesystem access, it's only for 'non-system' partitions (e.g. sdcard). Unless you rooted your phone (also a pretty tedious operation with a potential to brick the phone), normal apps can't even read files on the system partition, let alone overwrite them, except their 'own' data. This is good from the security point, e.g. you can run pretty much any app and simply remove it if you feel like it's suspicious and asking for too many permissions. Similar to running a random Docker image: you can try out software without taking risks of losing control over your system, allowing certain capabilities if necessary (e.g. ports, paths). There might be a Docker vulnerability of course, but it's pretty unlikely for you as an individual to be targeted by it. But it's extremely frustrating when you know what are you doing and which risks you are willing to take, but have to jump through hoops to do things that are otherwise trivial on desktop.