If this can happen, is it possible that once mandatory developer verification comes into effect, all 3rd party apps will be uninstalled at first and require a re-install?
Concerning this specific case, NFCGate is a tool on which malware (family) titled NGate by ESET is based, thus likely causing a false positive.
Oh, and no bypass is available anymore (aside from disabling play protect):
Android scanners are useful for known signatures, but I wouldn’t treat one as a full replacement for good install hygiene. Because of the app sandbox, a normal scanner can’t deeply inspect everything another app does.
Hypatia can help catch known files, but source, permissions, OS/WebView updates, and checking suspicious APKs before installing still matter more. A clean scan also doesn’t mean an app won’t abuse permissions you voluntarily granted it.