I would pay for an app store that maintained a currated list of apps which are actually checked for security and stability and tracking.
Pretty much F-Droid.
well, there's always the librem and pinephone, although they're not at the point of maturity just yet
the current system is already like this if you want to do sideloading/jailbreak/root of your devices. But that was the idea behind these stores: 'don't be like Microsoft and get viruses, we will make sure nooo malware ever enters our stores", which ofc is such a BS.
As for the developer in the story, he could've just make this a .pkg to be sideloaded by their clients, circumventing Google altogether.