If this can happen, is it possible that once mandatory developer verification comes into effect, all 3rd party apps will be uninstalled at first and require a re-install?
Concerning this specific case, NFCGate is a tool on which malware (family) titled NGate by ESET is based, thus likely causing a false positive.
Oh, and no bypass is available anymore (aside from disabling play protect):
SEO doesn’t mean that the site pays Google. It’s exactly the opposite. SEO means gaming the Google ranking algorithm to appear higher in the organic rankings without paying Google. In the past, people would do this by creating link farms to game the page rank component.