Earlier quoted context omitted.
> “ This ultimately hurts app stores ” Good, app stores need to die.
App stores are the least-unreliable mechanism I have to trust executable code. I don’t even enable JavaScript by default. Do you have an alternative trust mechanism that can’t be subverted via, for example, algorithmic voting?
Google Play Protect, for instance, works just fine on sideloaded apps or apps downloaded from other stores.
The distribution and marketing channel don't need to be the same as the trust mechanism. There's a whole anti-malware industry out there that can do the latter, and could easily do as good a job as Google currently do.