Accessing /data/app is possible without root permission; the permissions on that directory are rwxrwx–x. Execute permission on a directory means you can access it, however lack of read permission means you cannot obtain a listing of its contents — so in order to access it you must know the name of the file that you will be accessing. Android’s package manager will tell you the name of the stored apk for a given package.
To do this from the command line, use adb shell pm list packages to get the list of installed packages and find the desired package.
With the package name, we can get the actual file name and location of the APK using adb shell pm path your-package-name.
And knowing the full directory, we can finally pull the adb using adb pull full/directory/of/the.apk
Credit to @tarn for pointing out that under Lollipop, the apk path will be /data/app/your-package-name-1/base.apk