If this can happen, is it possible that once mandatory developer verification comes into effect, all 3rd party apps will be uninstalled at first and require a re-install?
Concerning this specific case, NFCGate is a tool on which malware (family) titled NGate by ESET is based, thus likely causing a false positive.
Oh, and no bypass is available anymore (aside from disabling play protect):
Are you new to Android? Play Protect has been a thing for a long time.
No. But I’ve never had it uninstall an app. Let alone one I had for months from F-Droid.