If this can happen, is it possible that once mandatory developer verification comes into effect, all 3rd party apps will be uninstalled at first and require a re-install?

Concerning this specific case, NFCGate is a tool on which malware (family) titled NGate by ESET is based, thus likely causing a false positive.

Oh, and no bypass is available anymore (aside from disabling play protect):

you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 5 days ago

Android scanners are useful for known signatures, but I wouldn’t treat one as a full replacement for good install hygiene. Because of the app sandbox, a normal scanner can’t deeply inspect everything another app does.

Hypatia can help catch known files, but source, permissions, OS/WebView updates, and checking suspicious APKs before installing still matter more. A clean scan also doesn’t mean an app won’t abuse permissions you voluntarily granted it.

  • source