I don't follow. Google could lock this down if they wanted to. They own System.loadLibrary, dlopen, and the kernel. If they wanted to enforce that native libraries were covered by the same signature as signed the APK they could. Maybe not now that the horse has bolted.