this was one of the options that came to mind while I was writing the second paragraph. nice that google is already doing that! they could've done... more of that, instead of 100% blocking users from sideloading things
(but also I'd be surprised if pegasus installed itself in a legal way, so it's not like this check will affect that kind of malware in any way?)