But the type of malware described in the article obviously is possible, given that it’s possible even on the Play Store. The OP posed switching to a decentralized model as a solution to that, and it’s hard to see how that makes any sense.
The wasted bandwidth would be made clear by the OS to the user too, so it'd be trivial to identify if it was a significant consumer.