If this can happen, is it possible that once mandatory developer verification comes into effect, all 3rd party apps will be uninstalled at first and require a re-install?
Concerning this specific case, NFCGate is a tool on which malware (family) titled NGate by ESET is based, thus likely causing a false positive.
Oh, and no bypass is available anymore (aside from disabling play protect):
It has the largest user base to target.
If it was normal to just search the web for all the apps you wanted, and you installed from from prompts on vendor websites, then all of the malware would come from that instead.
Google and Apple claim their stores address the issue. But it’s almost impossible to pay enough people to deeply review every single app and app update.
It would be easy to pay for it, but shareholders don’t like that