Cloaking is real but is itself a fun signal. Most apps (outside of the chinese market) don't use cloaking so observing behavior that seems like cloaking can be strong signal that an app is malicious even if you cannot determine what the behavior actually is.