Fun fact: 5/6 years ago, a bunch of Huawei phones came with world readable /dev/fb0 (framebuffer) device files. This made it trivial for any application to read the display, totally bypassing any Android screenshot/screen recording API (not that one existed at the time). Some of those devices also had readable /dev/event/input* files, which allowed touchscreen interaction to be monitored.
Sounds like a good backdoor with plausible deniability ("the dev forgot to restore permissions").
Here's another similar in concept (though much worse) one from Samsung: https://nvd.nist.gov/vuln/detail/CVE-2012-6422