with reasonable vetting like Google Play Store

Seemingly innocuous Play store apps get found to be viruses all the time, most recent in my memory being a few barcode scanner apps, farthest back in my memory being flashlight apps back before android did it natively, but there's been more over the years. Trusting apps "because play store" is horrible practice.