How would this type of attack work on an android that is locked to play store?

I guess you could use a web phishing page, but you couldn’t remote access their device. Maybe you could get a malicious data capture app into the play store that simply collects data, but it would eventually get banned