If an app logged your keystrokes and sent that data to some poor guy in a 3rd world country though Google would shut them down. Samsung is still allowed to host apps on the play store though. In both cases the data being collected will be leveraged against you. Google just doesn't care about malware if the developer is rich enough.
It's highly customizable, far better for programing and terminal work, and my only complaint is that the spell check is vastly inferior to the default I replaced. I suppose that's to be expected when you can't leverage the kind of data Samsung gets by spying on so many people's every word. I prefer to look at it as an opportunity to improve my spelling since I've gotten pretty damn lazy letting spellcheck figure out what I intended to type on the desktop.