I would assume that the screenshot functionality would be implemented as an OS-level, highly protected service (one that <uses-permission> in the manifest would

I would assume that the screenshot functionality would be implemented as an OS-level, highly protected service (one that <uses-permission> in the manifest would not be able to grant an app access to). Of course, if the phone is rooted, it's the Wild West and any app can potentially run the screenshot service.