> That seems like a severe security bug in Android APIs or sandboxing or something else.

No, this is the permissioned API that makes KDE Connect work, which makes Apple's Continuity look like a toy and that also lets me programmatically filter notifications.