How do anti-virus software programmatically scan code of installed android apps (without root privileges)?

There are several android anti-virus softwares which I know of e.g:

• AVG Mobile
• AVAST Software
• McAfee (Intel Security)
• Norton Mobile
• Kaspersky Lаb

etc.

Each of which offer functionality to scan installed android applications for viruses etc. (even android devices which aren't rooted).

Screenshots proving the above are below:

But from what I know of apps installed on unrooted Android devices, one app can't access another installed app and its associated files e.g:

• Pre-Install (i.e. Camera, Calendar, Browser,etc.) APK stored in /system/app/

• User Install (ApiDemo, Any.do, etc.) APK stored in /data/app/

• Package Manager create data directory /data/data// to store database, shared preference, native library and cache data

So how do applications like those described above, programmatically scan applications and their associated files as described above (Without root access)