What if the APK installation ran a few scripts? Overwrote files outside it's designated folder? Edited a few files? etc? What would prevent it from doing so?
An APK does not have any control over its installation process. Installation is performed by the Android operating system. Details can be found in this answer.
But once an app is installed, it can then run its code and try to make malicious changes.
What would prevent it from doing so?
At Linux kernel level:
- DAC (UID, GID, mode)
- MAC (SELinux labels)
Read more about Android app sandbox.
At Android platform level:
- Manifest permissions
- AppOp permissions