Yes, it reuses all the security features.

Doesn't each app run as it's own user? The OG of security features.

It respins UNIX security in favour of a mix of SELinux and a (mis-)use of UNIX user/group identities to contain apps instead of users. Linux distros sort of do that too but only for system services, whereas Android does it for user visible apps.