What's the deal here? Aptoide was malware? Or was it serving malware-infected apps? Or none of the above?
Who knows what other modifications were made.
If someone takes the Gmail app, injects a bitcoin miner and uploads it to a third-party store, who gets the blame?
My point is that saying it's all the consumers responsibility is a highly one-sided argument in favour of the vendor/service provider.
The amount of work a person would have to do to research every facet of every product they buy is insurmountable. There is no possible way for them to know everything about a product they are thinking of buying or using.
Expecting the average user to know which apps on any given app store are ridden with malware is a mighty tall order.
The customer will always have some level of ignorance about the product, so some measure of consumer protection is required.
It's unrealistic.