Modern phones being full of backdoors make this possible.

Even if Primal has no backdoors in its code, the backdoors in Android and iOS could allow the app to be replaced with a modified version while the system falsely presents it as the verified correct version of the app.

There are also a lot of apps where they just openly have the most available version replaced with something different from the open source version, and people don't even notice or care, to the extent that I don't even know if Primal is one.