[Android] Deprecate and remove loading deferred component .so files from app-writable internal storage (getFilesDir) #191139

Description

In PlayStoreDeferredComponentManager, searchPaths includes the app's internal files directory (context.getFilesDir()) as a search path for deferred component shared libraries (.so files):

https://github.com/flutter/flutter/blob/master/engine/src/flutter/shell/platform/android/io/flutter/embedding/engine/deferredcomponents/PlayStoreDeferredComponentManager.java#L430-L431

While PR #189145 ensures that OS-installed signed split APKs are strictly prioritized ahead of getFilesDir(), loading standalone .so files from app-writable storage is still supported as a fallback.

We should investigate whether this fallback is still necessary and work towards deprecating and removing it entirely.

Motivation & Security Concerns

1. Security / Code Tampering Risk:
   Loading native code from app-writable internal storage (getFilesDir()) poses a security risk if an attacker or another vulnerability manages to write to internal storage. Signed split APKs installed by the OS package manager provide signature and integrity guarantees that standalone files in writable storage do not.

2. Android Platform Restrictions on Dynamic Code Execution:

   • Target API 29+ (Android 10+): SELinux policies enforce W^X (Write XOR Execute) restrictions, disallowing execmod / code execution from writable app data directories for 64-bit apps.
   • Target API 34+ (Android 14+): Dynamically loaded files must be marked strictly read-only, further restricting dynamic code loading from writable storage.

3. Historical Context:
   Searching getFilesDir() was originally added when deferred components were built (~2020) to support fallback mechanisms, manual testing, or custom deferred component downloaders that unpacked .so files directly into internal storage rather than going through Play Feature Delivery. In standard Play Store workflows, deferred libraries are delivered and mounted via split APKs (splitSourceDirs).

Proposed Next Steps

1. Audit whether any standard Flutter workflows or supported plugins still rely on getFilesDir() for deferred component loading, and audit why it was originally included.
2. If legacy/custom downloaders need a migration path, document guidance on delivering native libraries via signed split APKs or read-only storage.
3. Deprecate and remove getFilesDir() traversal in PlayStoreDeferredComponentManager.java (and remove the corresponding native fallback paths).

References

• Discussion: Prefer OS-installed signed APKs over app-writable .so files when loading deferred libraries #189145 (comment)
• PR Prefer OS-installed signed APKs over app-writable .so files when loading deferred libraries #189145: Prioritize signed APKs over app-writable .so files