Ideally OS should give you a way to feed such evil apps some fake / spoofed data.
I believe a rooted Android used to allow something like that, not sure if that still works nowadays.
I believe a rooted Android used to allow something like that, not sure if that still works nowadays.
This can lead to an arms race where the OS creates increasingly advanced/realistic fake data, and apps get increasingly sophisticated logic.
So I'm not a fan of solving this the technical way. A policy is way better, but you need to be able to enforce it.
Sure, it'll lead to arms race like you describe on one side, but let's say 99% of the apps won't even engage in that arms race if the fake data is generic enough to cause a high number of false positives (blocking someone who's not actually faking the data).
Then, we can focus on the remaining 1% of worst offenders to actually enforce the policy.