They are basically heading down that path; I believe they started developing in private then they dump all their code twice a year for the public, which has made developing GrapheneOS (etc) way harder to manage.
I can only imagine they want to limit projects like Graphene, but they still want to release source because what made Android big was/is all of the “3rd party” phones like Samsung, etc… but now Google has their own hardware who knows what could happen.
It definitely feels like the end times where we are clinging onto our last freedoms (thanks to privacy friendly roms) before we privacy-seeking folk jump to linux phones (when they become useable/stable).
When would a scammer make you download an app? They could just as (more) easily make you visit a website…
It’s wrong to think this will stop scammers or malware.