Don't know if that is normal behavior, but how makes it sense security wise that you have to allow apps (for example the browser, or an alternative store etc.) that they can install apps, whilst you don't have to do this for the files app?
I know you still have to click on the install button, but where's the difference to just let any app do this?
Background is, i downloaded an apk with the browser and forgot about it. I found it in the stock files app and wanted to long press it at first, to erase it. I accidentally just made a short press and the install window popped up. I would have had expected that i would have to allow the files app to install something first?