In Android 6, Apps have to ask the user for the "Draw over other apps" permission, which is
However there are some notable exceptions that get this permission granted on install. Examples are almost every Google app, like the Photos app. Being a Google OS, this makes makes sense (and they are probably in the /system partition), but the same also applies to Facebook and the FB Messenger apps, downloaded through the store.
How can this be? Does Facebook pay Google to be on some sort of whitelist for the permission? Doesn't this undermine the whole purpose of the permission system?
Where are informations about whitelisted apps stored? Is it by certificate?
Does something similar exist for other permissions, too?