So the way it works is: an app initiates an Open intent with the apk, the system handles this as an install, then the installer checks to see if the app initiat

So the way it works is: an app initiates an Open intent with the apk, the system handles this as an install, then the installer checks to see if the app initiating the intent has the "install unknown applications" permission. The problem is that the user can grant any application that special permission. It shouldn't work like that; an app should have to list that permission as one it accepts, which would avoid scenarios like this without interfering with user freedom (you can download the apk sent on Telegram, then open it in your file browser or something which allows itself to be given app installation permission).