It's no longer true that APKs are signed by the developer, but it is still true that it is signed in such a way that a third party APK mirror site could not tam

It's no longer true that APKs are signed by the developer, but it is still true that it is signed in such a way that a third party APK mirror site could not tamper with the file without being detectable. Google could have tampered with the file before the mirror site got it, but you can verify that whatever a mirror site is offering was signed by them.