Even with this permission, you still need to manually verify every app you install. Background installation is reserved for apps part of the system image (i.e. Google Play, Samsung Store, Huawei Whatevertheycallit, etc.).
These apps don't just appear, they need to be confirmed every single time. For a dropper to get installed into the system and successfully install another app, you need to confirm four different security prompts. That also assumes Play Protect doesn't immediately get rid of the dropper; antivirus scanning, even for apps not part of the Play Store, has been built into Android system images for this reason.
I completely believe their story, I've seen these ad ridden crapdroids with my own eyes. But every single time they have come with malware preinstalled by some shady AliExpress/Amazon reseller.