I don't think so. It's more complicated than that. The state is not a monolith. Different heads are doing different things and it's a enormous bureaucracy. The divisions pumping out Android will eventually catch up to what's going on and the vulnerability they're exposing themselves to. These things take time. It doesn't all happen at once. People (who are not very technical, barely knowing what a computer is) need to understand what's going on and that can take a while. Let's just hope they figure it out before it matters.

It is probably unintentional. I work and worked in such projects (in The Netherlands), and the process is -rightfully- chaotic.

Governments typically don't have a central single team that builds all their android apps. They usually write a tender with loads of requirements and app-agencies will then build it. Or freelancers. Or volunteer teams. Or all of that. So there's no central team governed by one minister who can dictate what should happen today. There's hundreds of companies, teams, freelancers, interims, running around trying to make deadlines

Between writing a spec and the delivered app, there's chasms: could be a year between the specs are written and the first app pushed onto a phone. In a (trump)year a lot can change. But also between how specs are requirements or wishes in real life. "No user data may ever reach a google server" (actual specs are far vaguer and broader) may sound good, but will conflict directly with "user must receive push notifications of Foo and Bar". Or "passport NFC data must be attested for login", requiring a non-rooted, android, signed-by-google hardware attestation thingymajick.

So no, this is not malice. Nor incompetence. This is a sad reality, where we've allowed the monopoly to dictate what we, and users, expect, and to have that monopoly be the only option to provide those expectations.

For me the blame is squarely on the technical “experts” who are behind the architecture and implementation of such apps.