On the Sony Xperia Tipo (Android 4.0.4), the screen filter warning shows Google Play Services, which I would have expected to be excluded as a system app.

I'm guessing this happens because Google Play Services wasn't part of the original system image - it was installed when the Android Market app updated itself to Google Play. So I guess the flags don't indicate that Google Play Services is a system app.

If my guess is right, this will happen on all phones that didn't originally have Google Play Services installed. Maybe we should consider adding a special exception for it? But to avoid malicious apps masquerading as Google Play Services (on devices where it isn't installed) to bypass the filter, the exception would need to be based on the signing key rather than the package name.