How would they be screened? If you include native libraries in your APK, they're binaries, not code. They could scan the binary for API calls, but you're permit

How would they be screened? If you include native libraries in your APK, they're binaries, not code. They could scan the binary for API calls, but you're permitted to call dlopen() etc, so you could always hide a shared object in there and call it dynamically.