I don't get why this isn't blocked. If you're updating executable code, you should have to do it via Google Play. If it's just resources, sure, go ahead, but code?
Unfortunately, preventing loading executable code on Android would break many useful apps (e.g. Termux[1]). Also, arguably, it would mean that third-party browsers couldn't exist, since javascript is code, after all (iOS doesn't have this problem, as no third-party browser engines are permitted — all browsers are just skins over Safari).
OTOH, perhaps there could be a "permission-like"[2] flag on Android where an app would have to declare that it loads external executable code. Apps that did not use this flag, but were detected as updating executable code (even if not malicious), would be banned from Google Play. Diligent users could then check whether an app used this flag, if it seemed as if it shouldn't need it and be careful.
[0] https://developer.apple.com/app-store/review/guidelines/#sof... (§2.5.2)
[2] it wouldn't be an actual OS permission, just informational
In other words, even if you had some algorithm could somehow look at a program state and with 100% accuracy determine if that state was the start of an interpreter main loop, there would be at least one program where you couldn't be certain that you'd run your algorithm on every program state.
So the same techniques used by antiviruses, be it heuristics, signatures of known interpreters and droppers, simulated execution could be used by app stores to drastically reduce bad actors. The fundamental weakness will always be there for advanced, unique malware.
"Interestingly enough, we have also observed that most AV's also failed in detecting the dropper campaigns (sometimes for years), meaning that some awareness needs to be raised on the topic,"