Modern android resolved this by denying access to dmapp data outside of the class sandbox.

Older versions of android are completely vulnerable as they allow user level storage access between apps with user confirmation.