If you install an app that has permission to install other apps with arbitrary permission sets... Yes, you must trust them not to do anything stupid or maliciou

If you install an app that has permission to install other apps with arbitrary permission sets... Yes, you must trust them not to do anything stupid or malicious. However this is by choice you don't have to trust them although that means you should not allow them either. I would agree that conflating external storage options with shared storage was a huge mistake which made developers somewhat unaware that this is something that is actually not sandboxed as anything else would have been. But i think nonetheless it is the responsibility of the developer to not just assume how stuff works and in this case it is quite obvious if you actually happen to ask yourself if something like this would be possible. This is especially true if you require novice users to install your app with delicate permissions as the ability to install other apps. To be clear on this, they made the choice to use shared storage instead of using storage protected by androids sandboxing and permission systems. They probably made this choice without knowing that they are effectively allowing other apps access to files of their installer because shared storage has been conflated with external storage options but mainly because they did not evaluate the options they had and the implications of those carefully enough. Apparently Android 10 improved this somehow (probably by making filesystem permissions work as usual).