Look no further than the one-click root apps as an example. They exploit a vulnerability (usually on phones no longer updated or supported by their vendors) in the Android to gain elevated privilege to install a persistent piece of software, which usually is a system app in the form of a root access manager, but can also add daemons and other files wherever they deem fit.
When the device boots into safe mode only the system apps are available for the user to use, which also includes that superuser manager app in the aforesaid example. If an app installed a system app malware, then it would be booted even in safe mode.
Do note that it is not necessary that an app explicitly exploits a vulnerability to install a malware. Some vendors exploits their users' trust by turning factory shipped system level app into a malware, usually done by shipping a security or Android update to the devices. Some vendors even ship such hidden malwares from the very beginning. This is usually observed in low-end devices, but not limited to them.
We have many questions covering a number of Android versions and devices. Just search for the terms such as "malware", "system", "persistent", "factory reset" individually or in combination. Some examples of system level malware: