well, this is something that can be somewhat mitigated by giving users a meaningful choice of software repositories. Like, f-droid maintainers are trusted not to tamper apps because of their reputation. However, this would also require making third-party repositories ("app stores" is the modern fancy term) to have the same system privileges as Google Play / Apple Appstore have - and by this I mean giving apps access to third party push notifications services.