1. Do not trust Google to vet the apps in the play store. They won't; they don't even try.
2. Those shiny Play Protect and whatnot postured around by Google are practically utter useless bs/bloat
3. Stick to famous, really famous apps from the Play Store - as in well known - e.g. Facebook, Netflix, Evernote etc (you will be tracked of course, you won't be hacked - you pay this price by using Googled Android anyway)
4. If you couldn't find a well known app on Play Store - head to https://www.f-droid.org
5. Do not, just do not download any other app on your phone (treat it as a no exception rule) unless you know what you are doing and possibly can look at the code - find something decent as an APK from GitHub et al.
6. Be very miserly when it comes to doling out permissions to apps. Your default should be "no".
7. Privacy (not really) and safety are just superficial polish by Google on Android OS - their core and only focus developing the OS is: making it as much of an ad platform as they can and on top of that how to get a bigger and bigger cut of the overall ad revenue with every release.