If this can happen, is it possible that once mandatory developer verification comes into effect, all 3rd party apps will be uninstalled at first and require a re-install?
Concerning this specific case, NFCGate is a tool on which malware (family) titled NGate by ESET is based, thus likely causing a false positive.
Oh, and no bypass is available anymore (aside from disabling play protect):
I actually don’t think Apple ever described Mac OS X as open like Android did. The way Android did was always in contrast with Apple’s ways. That was their point.
Apple has boasted about narrow open things, like WebKit, and a few other things. WebKit was so open that Google forked it to make Blink. And WebKit was based on KHTML IIRC. Another open source project. And yes Unix was promoted in marketing. But they never claimed Mac OS X was open like Android did. They boasted about a Unix foundation.
Android never boasted about a Linux foundation. Just about being open.