The Worst Kind of Malware...

is the one you cannot know is there. Especially when that is over a period of years!
Apparently there is one of these out there on Android.

What to do? Toss your phone/device??
Well, No, of course.

But it does clearly re-emphasize what should be obvious by now.
DOing your homework for app vendors and looking through permissions are good starts.

If a vendor is generic and do not provide anything but an email address as "ID" - consider strongly staying away from them or, at least, seeking further information before installing. More and more, mobile IOS and Android devices are being used for important tasks and what you - or someone else - will install, matters as they are becoming more attractive targets.

Powerful, Hidden Android Malware!