They (like myself) mostly downloaded SMT apps from the Play Store, and of course just update them without looking at it since then.

The store page doesn’t have anything suspicious looking about it even now (who’s going to notice the missing ‘s’ at the end of “Offered by Simple Mobile Tool”) and it still says it’s open source.