Can a System-App read the data of other apps on Android 9? I want to know if a system-app is able to read the data of other apps (the data stored in /data/data.) on Android 9.

Thanks!
Yes! System Apps with the protection level signature (the System APK must be signed with the same key used to sign the ROM/Firmware), can read/write/execute/delete all data stored on  /data/data or other folders on the device.

Note that third party apps (OEM custom apps) found on system/priv-app with protection level signatureOrSystem (Deprecated in Android 6.0). may not be able to do this unless they have signature protection level which means signed with the same key as the ROM/Firmware.

Examples: I've seen some chinese manufactures with their built-in data clone solutions which can make a backup to the whole APK and it's data in another phone, and IMO, this is a security risk which should not exist at all on android devices.

EDIT 1: As i've mentioned before let's take a look at an Android APK which is able to copy other APKs data/data folders, it's called Amiclone "com.gionee.dataghost" from the Chinese smartphone manufacturer Gionee (which BTW, faced bankruptcy and liquidation on 2018)


We have the following information, from version 2.1.0w_pub build 20100022


Permissions:

android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_MTK_MMHW
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_SUPERUSER
android.permission.ACCESS_WIFI_STATE            
android.permission.BLUETOOTH
android.permission.BLUETOOTH_ADMIN
android.permission.CHANGE_NETWORK_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.GET_TASKS
android.permission.INSTALL_PACKAGES
android.permission.INTERNET
android.permission.KILL_BACKGROUND_PROCESSES
android.permission.MANAGE_DOCUMENTS
android.permission.MODIFY_PHONE_STATE
android.permission.MOUNT_FORMAT_FILESYSTEMS
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.READ_CALENDAR
android.permission.READ_CALL_LOG
android.permission.READ_CONTACTS
android.permission.READ_EXTERNAL_STORAGE
android.permission.READ_LOGS
android.permission.READ_PHONE_STATE
android.permission.READ_SMS
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.RECORD_AUDIO
android.permission.UPDATE_APP_OPS_STATS
android.permission.WAKE_LOCK
android.permission.WRITE_CALENDAR
android.permission.WRITE_CALL_LOG
android.permission.WRITE_CONTACTS
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.WRITE_MEDIA_STORAGE
android.permission.WRITE_SECURE_SETTINGS
android.permission.WRITE_SETTINGS
android.permission.WRITE_SMS
com.gionee.youju.statistics.permission.READ_PROVIDER
com.gionee.youju.statistics.permission.WRITE_PROVIDER

Signature:

Number of signers: 1
Signer #1 certificate DN: EMAILADDRESS=gionee@gionee.com, CN=Gionee, OU=Gionee, O=Gionee, L=ShenZhen, ST=GuangDong, C=CN
Signer #1 certificate SHA-256 digest: c2d992c8a4cda2eed55f69357d6759937878e9a0f0b629524e88aa81ed65f802
Signer #1 certificate SHA-1 digest: 1bb8b4f46eafc2a06a46ba68fd8de543a5c65cbd
Signer #1 certificate MD5 digest: b49792a5687b641492e10a29152f7454
Signer #1 key algorithm: RSA
Signer #1 key size (bits): 2048
Signer #1 public key SHA-256 digest: 858b75200e11e0e62f6377b0b56beb728085823bddc31669d8348ee28b651815
Signer #1 public key SHA-1 digest: c780dfb20637a7cedcaf78298ec1bfcb7b069da1
Signer #1 public key MD5 digest: ceb817433cbe5a6a3c42cc7a562617ab




Also, this APK has a built-in busybox binary, and it's able to dump the whole user data from /data/data folders while transferring Apps from a Gionee device t o another.

Conclusion:

Yes,  a system APK can copy other Apps and their data, but it's not only about signature as @Irfan has pointed out in his comment, there are permissions of different levels (some of them require signature level protection) etc...
But, as Android Enthusiasts replies are generally for end-users, the full details are not required to answer a question.