El Reg asked Google to comment on the incident, in particular the suggestion that crooks had figured out a way to smuggle malicious code past its security controls, but have not yet received a response.
The play store has security controls beyond "remove it if someone says it's infected"?