In the most basic sense - they should be concerned about malicious code because they're busy advertising and distributing those apps for a cut of the profit. I

In the most basic sense - they should be concerned about malicious code because they're busy advertising and distributing those apps for a cut of the profit. If Google were to say "No more checking for vulnerabilities in FDroid... (or insert other)" I would agree with your take - that seems like common sense. Not their store, not their problem. Same for side-loaded apps. But that's not what's happening. They're busy selling those malicious/vulnerable apps for a cut of the profit. Now - Google can be a responsible party here without having this program (there are plenty of valid discussions around whether this was really an effective way to combat malware on their store) - but to recap... The store doesn't get to absolve themselves of responsibility for the things it's selling. "It's the store's responsibility not to sell me malicious/defective products". If they can't do that... maybe they shouldn't be allowed to operate that store anymore.