Also, if you knew anything about IT Security, you know it's not about the source code, it's about the built artifact you install. Unless you build yourself from the source code, you don't actually know what's on the Play store / App Store.

It's the same sort of person that clicks the 'close' button on banner adds because they think it has to do what it says it does.

android.permission.GET_TASKS
because covid

Actually, you can decompile pretty much anything....

You'll loose some information (comments, indentation, etc) and of course, you can't compare it 1 on 1 with the source code, but you can still see the code from the play / app store and look if there is any sneaky stuff.

You can also use tools such as WireShark and other proxy tools to see what is communicated between the app and the internet/servers.