As others have hinted, Android already enables this via intents. Google Now doesn't even have to be aware of the app you want to use to handle a specific action. For example, it just has to fire off a "schedule an event" intent, and Android will route that to your preferred schedule management app. There is no security hole here - it's simple event firing and consumption, except it happens across apps. Security is handled by allowing the user to select which app they want to consume the event, and annoyance is mitigated by allowing users to specify that the selected app should always be used as the default. It's a marvelous system, and is one of the design decisions that, IMO, makes Android a massively more powerful platform than iOS.

Siri must be system-level because Apple has prevented other apps from being capable of assuming system default roles. It is an effect of iOS's design, not an inherent flaw in mobile OSes.