They are probably using certain flags to determine potential or likely maliciousness. I doubt this is as insidious as some of you are making it. Don't use Play Protect if this is really that big of a problem. Systems like this will never be perfect in a world with so many applications and bad actors. Some good software will inevitably be caught up in the net like this.