Current behavior on downloading an apk makes it pretty easy, IIRC it says you need to set a setting, has a (working) deeplink to the setting, and when you set the setting it prompts you to finish installing.

It's really not that hard anymore. Google Play Protect then yells at you about the app you just installed (but maybe that was because I was installing rooting apps). The best solution to someone installing garbage apps would be a system with an app whitelist managed by a trusted person off the phone. And no browser or incoming phone calls.