Malware is supposed to be stopped by the sandbox & Play protect mechanisms. If the sandbox isn't good enough to be trusted for that, I don't think I have a good

Malware is supposed to be stopped by the sandbox & Play protect mechanisms. If the sandbox isn't good enough to be trusted for that, I don't think I have a good answer except maybe just not downloading any app at all including on the Play Store. How I see it personally is you download the apk, tap "install", then the same permission prompt as the Play Store opens. The app is updated later the exact same way as the Play Store update (either automatically by pulling from an url or manually, depending of what the users have set as a rule for the Play Store)