because most of the times the malware simply uses completly normal and fine to use system api's to do what it wants to do. And for the deployment it simply gets added to cracked apps or just fake apps in general