Real talk: sideloading is allowed on android in the most maliciously compliant way possible.

Google restricts what other app stores can be included with devices that ship with play services

User-sideloaded app stores can’t auto-update apps

Play protect will flag any app that the play store has hashes of, but was installed by another app store. (Developers cannot, for example, upload a list of valid hashes for their apps to Google to prevent false positives here, effectively making other install routes appear as malware if they’re different.)