[brcmthrowaway]

Ultimately, does this require installing a sketchy app in the first place?

[piyuv]

Lots of credible apps use lots of dependencies. Find an abandoned one, get your code into it, …

[g-b-r]

Or a reputable one with that line of code included (in one of the updates, after having built a good reputation); maybe dormant until a certain date.

[MBCook]

Or a bug in some good app that allows an attacker to execute the right thing.

[saagarjha]

Yes.