The only time I've actually seen Android malware in the wild, it was because my mother installed a homescreen flashlight toggle widget from the Play Store that also displayed ads on the lockscreen. That was forbidden under Play Store rules, but there it was. I replaced it with something from F-Droid.

The Play Store still has a problem with shady apps years later. If Google wants to be more like Apple, they should start with better curation in their own store.