Why isn't the same warning shown when installing from the play store? Apps installed from the play store can have the exact same permissions as side loaded apps. You can claim that Google vets the apps, but this is pretty much false. Just go make an app and experience the process for yourself, it's laughable. Any checks they perform are automated, and there's no reason those couldn't just run on-device.

And besides, even for side loaded apps they have a database of "bad" apps that get deleted by Google called "play protect"

So you've gone through all the weird flows to accept and enable installing. Now how do you get security updates? Google scares them again every time, even though android apps can already execute arbitrary downloaded unsigned code at runtime (otherwise V8 and other JITs that generate machine code can't work), so it isn't really protecting much and mainly makes things more insecure by not letting you add your own trusted providers permanently for timely updates.

Something like enabling instant apps and play protect scanning for any apk on the web could mean a nicer and safer experience for users. I think people would still use the app stores for their discovery/convenience but safer web installs could be an option for both users and developers.

This model exists on desktops and laptops, where there is signing or browser scanning, just not on mobile.

To be fair, installing an app from the store might be harmful too.

> There are occasional bad actor apps that slip through Google's app store review process

It happens on a regular enough basis that consumer tech sites are warning users to be careful of what they install from inside Google's walled garden.

>With malicious apps infiltrating Play on a regular, often weekly, basis, there’s currently little indication the malicious Android app scourge will be abated. That means it’s up to individual end users to steer clear of apps like Joker. The best advice is to be extremely conservative in the apps that get installed in the first place. A good guiding principle is to choose apps that serve a true purpose and, when possible, choose developers who are known entities. Installed apps that haven’t been used in the past month should be removed unless there’s a good reason to keep them around.

https://arstechnica.com/information-technology/2020/09/joker...

...and is also appropriate for apps from the Play store. Google certainly isn't guaranteeing otherwise. If malware slips through, they will take no responsibility.

They currently have it both ways: 3rd party app stores get scary warnings front and center, whereas Play store gets the scary warnings and disclaimers of responsibility buried in TOS.