With the examples you listed doesn't it require an account to authenticate first before achieving this?
Furthermore, is this not easy enough to spoof? Without account based authentication (which as far as I know Unity does not use/require?) what stops me from spinning up VMs or emulators repeatedly to attempt to install bomb?