Likely by means of reverse-engineered APIs from smart TVs (or similar) with limited capability to provide integrity, although I'm sure there are steps Google can take to make that harder