If the apps are installed silently (i.e.without the usual installation dialog), presumably these apps directly call
PackageManager, which as a system app bears the permission
The phone has to be rooted so the app could call
pm in a root context, else you will be greeted with the message "Neither user xxxx nor current process has android.permission.INSTALL_PACKAGES".
EDIT: As @Izzy pointed out in the comment,
android.permission.INSTALL_PACKAGES is also granted to apps installed to
/system. See below comment and this SO question for more insight.