I think one attack vector this sort of overlooks in the first point, regular users installing malicious apps.
My elderly mum has an Android phone. She is not very tech-literate.
She might see a full page ad "your phone has a virus, clean it now", or somehow end up on something like it (e.g. a scam email).
She then dutifully clicks on it, which prompts to download an apk. The webpage provides clear instructions for how to install the just-downloaded APK.
That APK (app) then walks her though enabling ADB, so it can "clean the phone". The app gave very good instructions (customized to reflect the UI that her device manufacturer would use), so she manages to click through to the hidden settings menu and enable ADB.
The app can now exfiltrate all sorts of data, without needing any scary permissions prompt which will tell the user what is being accessed.
I think this sort of pattern is very real, and many users are being affected by these scams. And undoubtedly more android users than iOS ones.
Finding a balance that allows power users like me to use my device as I wish, and protecting regular users, is quite hard. I think the solution Google came up with of requiring a 24 hour wait, + some extra scary warnings, for unsigned apps is a step in the right direction, it helps less tech literate users avoid scams, and power users just have to be patient for 24h. But of course it's still not satisfactory for everyone, mum might still get scammed, and power users get annoyed at it.
Your post switched half-way from "this hypothetical app your mum might hypothetically install" to "this apparently real app doing these specific things". Which way is it? Are you describing an actual threat in the wild, or just speculating about possibility?
FWIW, similar kinds of attacks is exactly why side-loading apps is about to require a reboot and 24 hour cooldown. Which you mention at the end. It sucks, but it's a decent compromise; power users like me will just do the dance and pick the "indefinite" option the moment they unpack their new phone, and rest of the people will never even know about it until they're half-way through being scammed.
I personally don't believe doing anything more in this direction is warranted.