This might be unexpected, but I can't see how it would violate any ToS. Google explicitly allows alternative app stores and side-loading apps. Even apps sold through the play store often have in-app purchases which significantly change the app functionality.

I think changing permissions after being installed is pretty odd. Other than that, this has been done before. The Battle for Wesnoth app is just a wrapper that downloads the real game after you install it.

Presumably this downloads new executable code (or bytecode) rather than data. I could put up a shell app which does the same thing to download exploits after a while. This is why Apple has the "don't download code" rule (and why they had a "no interpreters" rule).

So maybe it's OK in the ToS right now, but I can understand why it shouldn't be OK, especially on a platform with so many local exploits (like Samsung's world-writable /dev/mem equivalent, etc).

EDIT: Actually they're just grabbing a new APK, which is weirder in a way since they are literally duplicating the Play Store mechanism but avoiding the good things that the Play Store tries to do for customers (static analysis for security risks, etc). Why wouldn't they just notify the user that a new version is available from Play? Bizarre choice.