These static analysis tools are just not good enough to rely on in a completely automated way and I guess Google is just not willing to spend the money on havin

These static analysis tools are just not good enough to rely on in a completely automated way and I guess Google is just not willing to spend the money on having flagged apps go through a manual check before being removed. We use one of those static analysis tools to find 'threats' as a sort of audit gatekeeper before release. Any issues found have to be addressed either by code changes or by comments. I'd estimate around 95% of the issues found are false positives. Examples include flagging the 'Random' class (C#) for not being cryptographically secure. This is true of course but that does not mean that there aren't a plethora of valid use-cases for using such a class. Then there's obviously all the cases where the tool is just not clever enough to follow the program flow.