From what I can see, this doesn’t need privilege escalation. Just for the user to grant it screen reader privileges, which many users aren’t conditioned to see as the giant flashing red alarm bell it is.

Malware is like fishing. Bait a million hooks and throw them out there, something’s gonna bite and get hooked even if 999,999 lines never even get tugged.