It's not really a flaw. Whether it is the same app or not is being distinguished by package name + signing key. If both versions are signed by the same key, for all intents and purposes the newer version is legit.

On Android, in offline scenario, the installer doesn't even know who is the author and whether it changed. Here, all it knows is the above: package name + key used to sign.