They're hiding Android versions on user agents for privacy reasons, but then allowing access to it through a JS api or a specific http header.

How does that help privacy exactly?