If this can happen, is it possible that once mandatory developer verification comes into effect, all 3rd party apps will be uninstalled at first and require a re-install?
Concerning this specific case, NFCGate is a tool on which malware (family) titled NGate by ESET is based, thus likely causing a false positive.
Oh, and no bypass is available anymore (aside from disabling play protect):
Android being “open” was always just marketing. The truth is more complex and not as sellable.
android is a box were the lid only closes halfway on its own, and it took them until now to care enough to close the lid