I don’t think malicious apps are making their money through Play Store purchases. Probably ads and data, and maybe by taking user credit cards directly.

Yeah the genuinely malicious apps are unlikely to be using Google ads or other services to generate revenue.