No doubt many “legitimate” apps, including some of Google’s own are spyware. This claims to be about the sort of malware that steals your bank account login.

I’d even speculate that most of the people involved are working in good faith; they think they’re the good guys and they can be trusted with that kind of power. Nobody should have that kind of power though because it always leads to corruption.

Public pushback on stuff like this does work on occasion. It even worked on Apple when they proposed upload filters for CSAM.

Google’s intent in the short term probably is just about malware, but in the long term it gives them, and governments which can pressure them the ability to ban any app from nearly all Android devices. Once deployed, there’s a near 100% chance of such a mechanism being used for evil.

So, yeah, as soon as they shot through the door, Castle Doctrine is in play.

Standard self defense law also covers this in every US state and most countries; if someone is shooting at you and there’s no way to quickly get to a place where they can’t hit you, it’s legal to kill them to make them stop.