I don't think malware is the problem, as most malware comes directly via Google's ecosystem carried by ads. Just recently I had to uninstall some app from the play store since it tried to distribute malware through scary pop-ups and had it replaced with something from f-droid for someone I know.
> most malware comes directly via Google's ecosystem carried by ads.
Google's own Play Store is filled with outright malware too, no ads needed. The idea that Google has to control what people are allowed to install on their phones isn't really for the protection of anyone except Google.