If we look at the Android source code, from https://github.com/android/platform_frameworks_base/blob/master/core/java/android/database/sqlite/SQLiteDirectCursorDriver.java, where most queries end up:
public Cursor query(CursorFactory factory, String[] selectionArgs) {
    final SQLiteQuery query = new SQLiteQuery(mDatabase, mSql, mCancellationSignal);
    final Cursor cursor;
    try {
        query.bindAllArgsAsStrings(selectionArgs);
        if (factory == null) {
            cursor = new SQLiteCursor(this, mEditTable, query);
        } else {
            cursor = factory.newCursor(mDatabase, this, mEditTable, query);
        }
    } catch (RuntimeException ex) {
        query.close();
        throw ex;
    }
    mQuery = query;
    return cursor;
}
You can easily see that in the only case the local variable for the Cursor is not assigned then a RuntimeException will be thrown instead. Meaning this function can not ever return null. 
You can hypothetically get a RuntimeException from the factory if used. Looking at the constructors for SQLiteQuery and SQLiteCursor no exceptions appear to be thrown. You can get an IllegalArgumentException if your bindings are incorrect during query.bindAllArgsAsStrings(selectionArgs);
Note an SQLiteException can be thrown later from the SQLiteQuery when the non-null Cursor is read.
That specific Android source code hasn't been updated since 2012. It is stable