If you are a software company, like valve, but to publish phone app. They have to go through Google store since that’s how you get that “verified” thing and you don’t have to enable developer mode. And for user that’s a peace of mind.

Is there a phishing website on PC, yeah, and how do you know? Usually it’s going through search engine or your bookmark and then check the HTTPS icons on your browser. There are also signed cert if you download and the windows exe launcher will check that with 3rd party cert. These alternative methods are not readily available on a phone, and that’s intentionally implemented so software developer will funnel back to the play store.

You can’t really open a android store unless you make phone and ship with your own store. Like Samsung one, it’s listed in the play store contract, almost all forms of paying developer directly is not allowed. There are many conditions/steps and warnings if you tried to install apps off the play store, some of them waive your warranty. You also open the phones to potential scammer to have identical looking website and instruct users to install app that steal identity.

I am fine with electric car that have software to monitor battery/motor efficiency and gives feedback for the driver/owner. But have it controls almost everything and can remote brick your vehicle is like you never really own the car.