Devil's advocate: there are APK extractors (which work without root), so it's definitively possible for an AV to scan those files and report if there's something weird.