Comment by daemonize

Don't worry, each vendor will have an opportunity to screw up SE for Android policy. Additionally, many kernel flaws will be possible to use for disabling these mechanisms to once again get privilege sufficient to write to /system if needed.