That analysis would be a lot more compelling if it didn't assume that all 3rd parties are the same. A 3rd party sending around a sketch apk that calls back to

That analysis would be a lot more compelling if it didn't assume that all 3rd parties are the same. A 3rd party sending around a sketch apk that calls back to them is _definitely_ going to try to do something bad with it. Otter is unlikely to do something bad with it (it'd be bad for their business). So you should really compare the odds otter gets hacked vs the odds the apk is compromised.