My understanding is that the "vulnerability" here also exists on every computer or other device on which you download an installer to a public folder--any application can watch that folder and silently replace the file with another when the download completes. There's nothing special about that. Android has a secure internal storage area--but internal storage is often limited. It's gotten better, but my previous phone only had 8gb for both the OS and data to share.