Except, side-loading has already existed on Android for... a long time. I regularly install from F-Droid, and it's totally possible to download an .apk from the Internet and install it. If your client was getting "cracked" it could already have been happening on Android for years (assuming you have an Android app). See also: Youtube vanced.

So really what you're saying in this comment is that you've written your backend APIs with the assumption that the only user is a benevolent app which you wrote. If it's possible for somebody to take your app and tweak it to circumvent your subscription's restrictions, then what prevents a person from hooking up their phone to a development HTTPS proxy, intercepting the API requests, and making their own cracked client without side-loading at all?

Side-loading is NOT a problem for subscription apps done properly, and it's NOT a problem for privacy or security, so long as the side-loading implementation is done responsibly.