Assuming I developed an Android app using the Google Identify Platform as its ID system. In Google's Identify Platform doc (https://developers.google.com/identity/protocols/OAuth2InstalledApp), it says "Your app must register with the system for the custom URI scheme in order to receive the authorization response".
My question is if a hacker reverse-engineered my APK and figured out my custom URI scheme. He then used that custom URI scheme and released his own Android app with that URI scheme (https://stackoverflow.com/questions/2958701/launch-custom-android-application-from-android-browser). Then Google can be sending OAuth 2.0 authorization response (auth code) to the hacker's Android app.
Isn't that a big security problem?