they just want to confirm a malicious actor didn’t develop it

So Newpipe, SmartTube, Nintendo emulators...

Clones of opensource apps bundled with ads that violates license is OK, but restricting everyone to build and test apps from source so it can test new features and report any issues is too risky for the user