Если исходный код одного из приложений опубликован в открытом доступе и туда каким-то образом попал релизный keystore, то злоумышленник, который взломал ваш gplay аккаунт сможет "обновить" приложение с трояном.
Возможно он сможет написать своё приложение, которое будет воровать данные из вашего, хотя тут не уверен, мб нужна поддержка с обоих сторон приложения.
https://developer.android.com/studio/publish/app-s...- App upgrade: When the system is installing an update to an app, it compares the certificate(s) in the new version with those in the existing version. The system allows the update if the certificates match. If you sign the new version with a different certificate, you must assign a different package name to the app—in this case, the user installs the new version as a completely new app.
- App modularity: Android allows APKs signed by the same certificate to run in the same process, if the apps so request, so that the system treats them as a single app. In this way you can deploy your app in modules, and users can update each of the modules independently.
- Code/data sharing through permissions: Android provides signature-based permissions enforcement, so that an app can expose functionality to another app that is signed with a specified certificate. By signing multiple APKs with the same certificate and using signature-based permissions checks, your apps can share code and data in a secure manner.
