You're completely ignoring existence of silently updated Play Store and Play Services which are controlled by Google and have enough permissions to do exactly w

You're completely ignoring existence of silently updated Play Store and Play Services which are controlled by Google and have enough permissions to do exactly what you think they can't.