That only works if you trust the store, and you somehow only know how to audit from source. Neither is true for professional audits: you'd generally start from

That only works if you trust the store, and you somehow only know how to audit from source. Neither is true for professional audits: you'd generally start from the APK anyway, even if it's minified, and in many cases you'd actually get the source (which is an optimization only, e.g. to make bug descriptions better/faster).