The SD card has been part of the Linux file system since 4.4, so unless you use an app that changes that (NextApp SDFix: KitKat Writable MicroSD (root) does), only an app that has permissions to write to that folder can. (There's a valid reason for Google doing that, but I still disagree with it - valid and "should be done" aren't the same thing.)