How do these emoji enablers manage to remain undetected while using WriteToFile outside sandbox?

Question

Is there Hidden API that enables emoji?

Is there a hidden API that allows writing outside our app's sandbox secretly without detection?

HOW?! This is really baffling!

Answer 1

No, there isn't.

Answer 2

My guess is that they use NSUserDefaults' -persistentDomainForName: and -setPersistentDomain:forName: to set a global user default (in NSGlobalDomain), though I'm not certain.