So not only do they have the theoretical ability to publish their own code with your private key that has full access to your apps private data, they even do it

So not only do they have the theoretical ability to publish their own code with your private key that has full access to your apps private data, they even do it in practice? They don't need to do any of this to keep your local data without keeping the entire app. Android phones have had the ability to uninstall apps without removing their data for some time. Any time you can install the application again and if the keys match, it has access to its data. But that wouldn't create a good excuse for Google to ask for private keys from developers.