"the lesson here is that restricting people to the OS vendor's software repository doesn't prevent malware"

This was a side-loaded app on an unlocked phone. What am I missing?