Running in user space is not enough. It would need root. It is also hard to keep root, when you have dm-verity and selinux in enforcing mode.
Android applications are also sandboxed from each other. You would have hard time getting from one app to another's files, unless the original app published them - or you've got root.
