Keeping malware out is hard. The app approval is a decent place for security checks, but it's not perfect.

https://www.wired.com/story/google-play-store-malware/