Android - How are "ShareIt","Xender" etc able to install APK without requiring "unknown source" permission?

I did a bit of digging and it is possible without System permissions from API 21 onwards

In fact, there is a code sample by Google which shows how to do it.

If the apps are installed silently (i.e.without the usual installation dialog), presumably these apps directly call pm, i.e. PackageManager, which as a system app bears the permission android.permission.INSTALL_PACKAGES.

The phone has to be rooted so the app could call pm in a root context, else you will be greeted with the message "Neither user xxxx nor current process has android.permission.INSTALL_PACKAGES".

EDIT: As @Izzy pointed out in the comment, android.permission.INSTALL_PACKAGES is also granted to apps installed to /system. See below comment and this SO question for more insight.