If an app has the permission to spoof signatures (which must be specified in its manifest - I.e. it's not a permission that's grantable with `pm` ) it can spoof

If an app has the permission to spoof signatures (which must be specified in its manifest - I.e. it's not a permission that's grantable with `pm` ) it can spoof itself as being any other app, if my understanding is correct. This opens the door to sketchy apps pretending to be system apps, then man-in-the-middling your data, potentially leaking sensitive info, etc. Generally the signatures are there as a tamper-proofing mechanism. Some builds (e.g. official-ish LineageOS for MicroG ROMs) have a hardcoded notification that's shown for the signature spoof permission so it can't happen in the background, though. The possibility of widening the attack surface just triggers security paranoia in those of us ditching Big G for privacy reasons - that's why there's controversy over it at all.