This is more than doable with app stores. The review process never instruments the apps or reads the source, it's trivial and common to hide malware in apps and then use modals/ads to push them on people.