schwim Sure. Aurora does not verify Play Store apps' signatures, so you're using Trust On First Use (TOFU) installation. There is no guarantee whatsoever that the APK hasn't been tampered with. App stores like Accrescent and the Play Store avoid TOFU by verifying certificates on install. This issue can be avoided if you verify the app's certificate hash using AppVerifier, but you still run into the issue of getting that hash from a trustworthy source (the official Play Store itself).
Additionally, most users will use an "anonymous" account, which is shared between many users. The issue here is that Google often rate-limits and blocks these accounts. This means you won't be able to consistently get background updates, even if you do configure them in Aurora.
Aurora can also grab outdated versions of apps, as well as incorrect builds.
It also does not avoid Google tracking. Apps that include proprietary Google libraries can give Google exactly the same access that Play Services would have, regardless of whether Play Services are installed. Aurora itself sends a large amount of data to Google, including a full list of apps unless the user manually blacklists the non- Play Store apps that are installed.
