If you've got to the point where Google is specifically pushing you a modified app, Google could just push a backdoored keyboard update that exfiltrated all your keyboard inputs instead. Why bother targeting a single app when you can get everything?

I think Android is designed such that even the Play Store cannot replace an installed app with a differently signed one. Or at least it used to be. And, "Android" is controlled by whoever made your phone, not directly by Google unless it's a Pixel device.

That said, it's a thin line. If Google had changed things at some point so that the Play Store could override the signing continuity requirement I wouldn't be remotely surprised.

> I think Android is designed such that even the Play Store cannot replace an installed app with a differently signed one.

They can’t, however Google have recently changed the requirements for submitting an application to the Play Store. You now need to hand over your application signing key. Instead of signing the application to prove authenticity to Android devices then giving it to Google to host, you now sign the application to provide authenticity to Google, and then Google re-signs it with the key you gave them to prove authenticity to Android devices.

So if Google want to provide an alternative binary to a specific person, they can now do that.