> A scam app with root can draw over the screen and tell users to transfer money

On android, I believe this can be done rootless via accessibility permissions that can display on top of apps

Yes, but you very much have to grant that permission in Settings. An app can't get it non-interactively.