So, a "feature" in the installer allows an already installed malicious app to install even more malicious apps.

That new malicious app then gets to somehow have more permissions than the original malicious app or the installer.

Guys, that's an Android bug. This is exactly the kind of thing that needs to be fixed at an OS level, you can't be relying on the competence of arbitrary developers to maintain the security of the system.

Of course it's an opportunity for Google to use their own broken security model as an argument on why apps should only come from their own "curated" channels (which presumably also host the malware exploiting this). It just so happens to be their source of revenue...