All of tachiyomi extensions are APKs since a long time ago. Previously we just trust it because it's hosted by tachiyomi itself. So you should still worry about the trustworthiness because it's hosted by unrelated person, but shouldn't because it's apk.

Maybe in the future Mihon should implement support for non-apk extensions, but for now we can only use that

There's source code repo for those APK: https://github.com/keiyoushi/extensions-source