Yeah, they did that using a very aggressive Google-provided tool called SafetyNet designed exactly for that purpose, which downloads a program from Google's servers and runs it with system-level privileges to do the checks.