Yes, that is a weakness. But people have to do the same thing when they install F-Droid, or any other software directly from a developer's website. Maybe it is safer to trust an app store, but I've recently heard stories of hundreds of malicious apps getting past app store verification too.