Yep. If I might add a footnote for HN reader convenience: Epic actually fixed it by following the second approach you mentioned.

According to Google issue tracker: "This patch changes the default APK storage directory from external to internal storage, which should prevent MITD attacks during the install flow."

https://issuetracker.google.com/issues/112630336#comment5