Ask HN: How to apps like GBwhatsapp work?

There are incredibly popular apps active here (SEA) that seem to extend the functionality of whatsapp, with features like messing with the read receipts on a per contact basis, automatically cleaning up groups etc.

They seem to work as standalone apps, you can have both the normal whatsapp and this alternate app active on a single phone. They dont use the whatsapp web interface either, or if they do its not visible on the main application.

This is obviously a massive security risk, surely there is a way for WA to verify the integrity of the APK before accepting requests to their API?