And on iOS, if your app does not receive permission to access your location or contacts or camera or Internet, there's no way to do that by using objc_msgSend or whatever.

On both platforms, these security policies are enforced at the process boundary, not by the runtime.