If this can happen, is it possible that once mandatory developer verification comes into effect, all 3rd party apps will be uninstalled at first and require a re-install?
Concerning this specific case, NFCGate is a tool on which malware (family) titled NGate by ESET is based, thus likely causing a false positive.
Oh, and no bypass is available anymore (aside from disabling play protect):
Android being “open” was always just marketing. The truth is more complex and not as sellable.
Everyone tried to use the same model, even MacOS reboot sold itself as Unix and the open-source portion of the platform used to be much larger. You could edit a config file and make it load text console only in the early years.
Annoying, really, as every one of them preach openness until they get so big, and then they seal the gates because they think they have their market locked down.
Not anymore.
Will be interesting to see how android dies. It will be slow, but it is a given.