This seems to be done through the accessibility services, which makes sense: they're built for apps like screen readers that must by nature be able to read the content of other apps. Each app has to be manually authorized by going to the accessibility menu, and there's a big scary pop up that says "enabling this app will allow it to see and interact with everything you do."