If you read the Vice article, it explains that they were compromised by on-device "malware" that was pushed in an update via the company provider (whose software update process had been taken over by the authorities).

So it doesn't matter what software they would have used since the device itself was capturing data before encryption and after decryption.

They could have been using regular iPhones/Galaxies/Pixels etc. Then it wouldn't rely on this bespoke operating system and its updates. It seems unlikely Play Store or Apple Store would get compromised. But you could always compile the PGP app yourself.

Could law enforcement require access to play and appstores? Has this happened?

Law enforcement could replace an app, with their own, even for one specific user, if they have access to the system, granted by Google or Apple. I presume the signing can can be compromised, this way, but am unfamiliar to know this for sure.

Using those stores means using those centralized services by Apple and Google, which includes device updates, carrier updates and more than just app store downloads.

And those companies would absolutely comply with a legal request to push intercept updates to phones.

Well, it tells you a lot about the ease of use of PGP when people prefer to go to jail rather than use PGP ;P