In the unregulated scenario, you at least know the score. In the current scenario, you have a false sense of security that this must be the real deal, because Apple reviews the app submissions.

The problem with app stores is that they sell the idea of verifying trustworthiness when the really can't. The biggest effect they can have is by doing identity verification and they make the same mistake that EV TLS certificates, etc. did. That mistake is assuming business names and trademarks are unique. They're not.

The entire software distribution industry could use a mulligan. I think it should start by using domains as identity because it's the only namespace we have with global buy-in and anyone can register / reserve a unique identifier (aka domain) in that system.

If the supply chain for that app went back to 'lastpass.com', and that information was prominently displayed, it solves a lot of problems in terms of educating users to help them avoid scams.

https://play.google.com/store/search?q=lasspass&c=apps&fpr=f... shows that Parvati Patel didn't even have the forethought to submit to multiple stores, for maximum phishing. Or, from Apple's perspective, worse may be that they did submit it and Google either caught it or its review cycle is so hopelessly borked it didn't outrun the news coverage. Hard to tell who is the most facepalm of all these actors