Unless one is diligent about checking that the app ID turned out to be the same in the destination profile after installation, the extractor app or the file transfer mechanism could have tampered with the .apk
Can do a quick & simple check in the owner user profile as Settings > Apps lists all apps installed on all users on the device. As you point out a malicious altered app, installed on the same device as the legitimate app, would need to have a different app id. So you would see the same app listed twice when searching the app list. At the bottom of their app info page you would see different package names (something like - com.company.appname)
Its also possible to check the apk signature fingerprint which is unique and is what the system uses to ensure that app updates can only come from the same source as the installed app.
Theres a decent database of fingerprints at https://beta.pithus.org/
Can check the signature fingerprint of apks and installed apps using something like https://github.com/xgouchet/Stanley (they call them signing certificates)
Can get fingerprints from apks using apksigner verify -verbose --print-certs name_of_the.apk from a terminal
Shizuku also requires granting access to the android debugging interface (adb) which always opens up a significant security hole and is still best avoided if at all possible. Developer options are meant for development purposes and can seriously effect the security of the device and/or break unexpected things. e.g. there has been a serious bug in the past that only hit people who had played about with the display cutout setting in developer options