So far the answer is:
Some checks to vet the risk:
- Has been updated in last few months (maintained)
- Developer has resources to debug
- Big Organisation where reputation loss is an issue
If no to any of these, then don't use the app.
Reviews do not mention security issues
App asks for odd permissions that shouldn't be needed (privacy labels may not be reliable on Google Play Store, Feb 2023 [2])
If Yes to any of these, then don't use the app
Project/developer has reviewers/Large, popular open source app across multiple platforms
- This may be ok but I'm unsure if that works, as it depends if the code is reviewed by sufficient 'Good' Actors I assume?
Related:
What security reviews are done on apps in mobile app stores? This question is listed as out of scope but perhaps research blogs if you want more information. Currently no change to the advice above