If you can modify an init.rc then you can bind mount over the apex mount before the Zygote runs.
Much like any user could fork Chrome in principle and scratch their particular itch, but the sheer pain makes that not worth it except for motivated, organized teams
I'm not sure reverse-engineering some Java bytecode is even the rate-limiting step at this point, I'm more demotivated by the knowledge that everything will break again with energy-sapping frequency