Considering that MindTheGapps is a distribution of the real Google Apps packages, yes, it's too late.

https://mindthegapps.com/

Note that MindTheGapps is distributed at https://github.com/MindTheGapps/. The dot-com domain looks like unaffiliated SEO squatting and could change download links to malware anytime.

There's also https[//]microg.cc and https[//]microg.net, both masquerading as homepages for MicroG, and Duckduckgo finds several more. I actually reported the latter to Namecheap a year ago, but got no response back.

Is there a good authority to report these to? Clearly registrars aren't interested in taking them down, and they're probably not serving malware right now, but fake download sites for software running with elevated privileges is a security incident waiting to happen.

Ah no! Oh well.