How are "ShareIt","Xender" etc able to install APK without requiring "unknown source" permission? Normally, if I have to install an apk(say from SD card), I need to enable “Unknown Sources” in my phone's settings. But when I transfer and install any APK from another phone using "ShareIt", no such permission is required by my phone.

How is ShareIt able to bypass this permission?
I did a bit of digging and it is possible without System permissions from API 21 onwards https://developer.android.com/reference/android/content/pm/PackageInstaller.html.

In fact, there is a code sample by Google which shows how to do it. https://github.com/googlesamples/android-testdpc/blob/master/app/src/main/java/com/afwsamples/testdpc/cosu/CosuUtils.java