“It is frightening that with one update an app can turn malicious while going under the radar of Google Play Protect.”
The app sat on Google Play for years with no trouble. Then an update added heavily obfuscated adware, signed with the same certificate as the clean versions. Google’s scanner missed it. Pulling it from the store didn’t remove it from 10 million phones. Every auto-update is a blank check to whoever owns the app this week.