It checks apps from the Play Store before you download them and scans your device for apps installed from other sources (sideloading).

The initial app is clean, but once installed, it downloads and executes malicious "payloads" from a remote server, bypassing the initial scan.

This article explores what these "bypasses" actually are, why they appear on GitHub, and the significant security implications of using them. What is Google Play Protect?