The time limit prevents this from becoming a normal distribution channel for legitimate apps, which would condition users to click mindlessly through it. It an attacker wants to try, most people will think it’s weird and scary. But developers only need to do basic developer things (cut builds) to get around it. Pretty clever if you ask me.