If this can happen, is it possible that once mandatory developer verification comes into effect, all 3rd party apps will be uninstalled at first and require a re-install?
Concerning this specific case, NFCGate is a tool on which malware (family) titled NGate by ESET is based, thus likely causing a false positive.
Oh, and no bypass is available anymore (aside from disabling play protect):



Had heard they could uninstall programs for years now, but never seen a report of that actually being done.
Alas, does Play Protect help in anything? Power users are likely to know what they’re doing, and normal users are likely to be using only the programs Google already sanctioned due to being on Google Play, so I personally can’t see much room for it.
About your question, hard to confirm anything. But with Google existing on an eternal slippery slope, I think it’s safe to say not if they’re doing it, but when.
I mean there is the problem of malicious apps on the Play Store (though that should be handled by Google reviewing submitted apps better). Maybe Play Protect could uninstall those once they’re discovered? Seems a bit late. There’s uninformed users being fooled into installing malicious APKs outside of the Play Store by blindly following malicious instructions, but Play Protect is just another step to follow.
I figure what’s more valuable to Google is the marketing that Android is secure and a list of apps installed on your phone.
Google is a sellout hypocrite of the highest order and has been for…15, 18 years?
Android being “open” was always just marketing. The truth is more complex and not as sellable.
Happened last year with BLE Radar when police/ICE realized people could see (the presence of) their body cams.