They could have been using regular iPhones/Galaxies/Pixels etc. Then it wouldn't rely on this bespoke operating system and its updates. It seems unlikely Play Store or Apple Store would get compromised. But you could always compile the PGP app yourself.

Could law enforcement require access to play and appstores? Has this happened?

Law enforcement could replace an app, with their own, even for one specific user, if they have access to the system, granted by Google or Apple. I presume the signing can can be compromised, this way, but am unfamiliar to know this for sure.

Using those stores means using those centralized services by Apple and Google, which includes device updates, carrier updates and more than just app store downloads.

And those companies would absolutely comply with a legal request to push intercept updates to phones.