Depends on the project. Look how many people use it. If it’s a bunch, chances are other people also keep an eye on it. Even better if you get that sofware packaged. That means from the package manager of your linux disteibution or - in your case, using Android - from F-Droid. This way somebody from that theam has a look at it, and F-Droid even strips all those Trackers from Apps. I’d say chances for a virus/spyware getting through the F-Droid process are close to none.

Play Store doesn’t do anything against excessive tracking.