What is to keep a clever hacker from maliciously installing a “trusted“ app on all of my friends’ phones and tricking me into installing the Trojan horse as well? My trust in their ability to have good opsec?

(It’s a trick question, I have no friends 🤭)