Yeah if this was "just" a file manager that could potentially download APKs if you paste in a direct URL or connect to a file share then there's no way automated testing would have flagged this. The changelog seems to mention a "backup/restore" feature for APKs which seems different than just triggering an open intent.