Google literally controls the software delivery platform and silently updates a highly privileged service called Play Services on every phone. That service can

Google literally controls the software delivery platform and silently updates a highly privileged service called Play Services on every phone. That service can access and backup data from apps private storage. They really really don't need to touch your APK to get any user or app data. If you don't realize that, you may have been thinking of wrong threat models.