The Android team is doing a very good job to secure the firmware. The firmware insider protections is a direct answer to the latest supply chain attacks.
I have the feeling that Google is restricting more and more what the app developers can do (ie the service limitations, how to launch an activity)
They have a big work to do on the app distribution. And this is my biggest question: Where are the “Google Play Protect” talks/team/announcements? Did I miss them?