I still think that is a terrible default for the truly paranoid.

Google could, at any time, initiate a cloud-to-device intent to install arbitrary software that you "wanted" from Google Play. They don't unless they ask you to, but the capability is there.

The bigger thorn is if you're on a device where the manufacturer or carrier has hidden or removed the option to install arbitrary APKs.