I'm referring to bad actors adding things to the APK or altering it, though there is more evidence of the issue raised in the post below yours: folks who attempt to gather info from users in order to offer the software (outside the app stores) and from those pages collect other user info and introduce malware.