Yes, in our case we did MITM to display ads for a "free burger" app containing malware. The app was hosted on Google Play.

And, you're right. Once we have access to the phone we can probably do a lot worse than just stealing a car.

When it comes to banking apps, they often have mitigations which would require a lot more targeted effort.