Comment by array_key_first

Sure, but the reality is that your average Linux distro repo has WAY less malware than the play store.

Your security model doesn't matter much when the people doing the security are bad actors. Google is a malicious actor - they actively incentivize malware on the play store.