Right, that was my assumption too. Sideloading would be my way around, but I'm guessing there may be some runtime signing or containerizing involved as well, else every Android vulnerability just became a Windows vulnerability.