[dvngnt_]

> A scam app with root can draw over the screen and tell users to transfer money

On android, I believe this can be done rootless via accessibility permissions that can display on top of apps

[NoGravitas]

Yes, but you very much have to grant that permission in Settings. An app can't get it non-interactively.