If it makes my phone, that I paid for, do things I dont want it to do then it's malware.Especially because those things make the device less useful to me.

Google thinks they own my phone. They do not. I do not consent to this change, and will be voting against it by using the only remaining option: Moving completely out of their ecosystem.

They really left me no other choice when they decided that they didn't need the owners consent.

The comparison is not Google app store security vs nothing.

It's app store security vs app store security with verified developer IDs

The fact that the android fraud is not endemic means that the later is not worth the increased risk of losing your Google account.