[Owlettotoo]

"Most of the news coverage of Google’s move against Pinduoduo emphasizes that the malware was found in versions of the Pinduoduo app available outside of Google’s app store..." Given this, it could also be the work of some shady third parties.

[Apfel]

Play store doesn't work in China, so it'll be in the Chinese equivalents, which will be run by the ultimate shady third party (CCP)