Interesting.. I don't think this would explain the users who claim the app keeps coming back after they've removed it? Is installing Android from another user's image a popular thing?
It's possible, if that image has a startup script to fetch the .apk from a third party source & install it. I've put custom/specialty ROMs on old Android devices in the past and they often come with random apps I don't need and uninstall on first boot.