I'd imagine the dalvik part to be pretty open to static analysis?

On the desktop JVM, I've seen bytecode that decompiled to a form more readable than the original source I got access to later...

Yes, but the JVM allows so much use of reflection that it's easy to hide an interpreter and then hide everything else from any static analysis.