The culprit could be Google Play protect. You need to use a google account to use Google Play, and then Google Play periodically scans apps, even if they aren't

The culprit could be Google Play protect. You need to use a google account to use Google Play, and then Google Play periodically scans apps, even if they aren't downloaded from Google Play like F-Droid (even apps I loaded for testing using adb). So that scan, whose results are sent back to google could reveal NewPipe and associate that with your account.