On android only the apps and updates are signed. In the normal system state is the only writable part the encrypted data partition, system,vendor and product a

On android only the apps and updates are signed. In the normal system state is the only writable part the encrypted data partition, system,vendor and product are readonly mounted and can be only be mounted in the writable mode after an update is verified and the update binary mounts the partition writable.