Not necessarily, the app could be installed outside of Google Play. A user could click on an malicious web link that would download the application and prompt

Not necessarily, the app could be installed outside of Google Play. A user could click on an malicious web link that would download the application and prompt them to install, much like https://m.spotify.com/us/ https://m.spotify.com/us/ allows the user to do.