Manual Installation of APK / strange behaviour

CAD

Dear Community,
I'm just getting settled in GrapheneOS on my secondary device to become my primary device and I observed a strange behavior (in my eyes).
I downloaded the Threema messenger from their own shop as an APK and dragged the APK file from my PC to the phone via USB cable.
Then I unplugged the Phone.
From the File manager (at the time the file manager was set to "not allowed" in "unknown source installations") in the Phone I clicked the APK. I was then shown a hint that said that "unknown apps might be a risk ..." but it allowed me to install it after I confirmed.
From my other phone (Stock Google Android), I wasn't even able to install it (Promp shows: For your security, your phone currently isn't allowed to install unknown apps from this source.) unless I actively trust a source (e.g. Filemanager).
This behaviour somewhat confuses me... Does anyone have an explanation for this?

I am looking forward to your help :) Kind regards

System:
(GrapheneOS 2025112101, Pixel 9a)
Installed the app on 2nd user profile (NOT owner)

Olaolaho

CAD

That's just a wake up calll that installing apks from outside the app store is a risk.. You need to allow if you trust the download to be able to install it.. Nothing weird or strange.

Just out of curiosity.. Why downloading threwma on your PC to install it on your phone? Why not download directly from the threema shop on your phone?

CAD

Olaolaho
Hi thanks for the quick reply.

yeah that "wake up call" is understood.... what bothers me is that the filemanager in GrapheneOS is not yet a source where I allow to install apps... yet I was able to install the apk with clicking on "continue" .... that was strange to me ...
I hope its clear what i mean :D

in the stock OS i have to actively accept filemanager as trutworthy source from where apps can be installed ... otherways I am not able to install apk.

to your 2nd question: I am still having a mailbox only on my PC ... there I got the link from threema (invoice) where I was forwarded to the download... furthermore I wanted to confirm the SHA256 hash of the APK to verify it....that is why :)

kind regards

EDIT:
or in other words...
If I go to Settings > Apps > special app access > install unknown apps > "Files" from GrapheneOS is NOT ALLOWED ... yet I was able to install the APK (located in the download folder)... the stock OS wont even let me install an APK with this setting/constellation (I tried it :) )

CAD

EDIT/FYI:
On Github issue tracker link here it seems that this behavior was observed by others and that the GrapheneOS Team has it on its radar.