For apps that really need security, android porivdes attestation using secure element. https://developer.android.com/training/safetynet/attestation https://dev

For apps that really need security, android porivdes attestation using secure element. https://developer.android.com/training/safetynet/attestation https://developer.android.com/training/safetynet/attestation https://source.android.com/security/keystore/attestation https://source.android.com/security/keystore/attestation So it's not all wild west. But most apps don't need this level of security.