verifying apps

Always. A trustworthy publisher hands you the signed AAB (what ships) and APK (what you can test) on request. If they refuse to show you the build going out under your name, that's your answer. How to verify a build.

Install it on a test device, read the permissions against what the app claims to do, decode the manifest with aapt or apkanalyzer, inspect the code with apktool/jadx, and verify the signature with apksigner. Full checklist.