yes that is the cynical take, and I mostly agree, but installed apks list their install source, so if that information is there, then its simple to give the user the ability to mark said source as trusted.

For now.