> So we should just accept that all apps must treat android notifications as a compromised communication channel?

Look, that's an OS issue, not an app distribution issue. If I could use the trusted, vetted software from F-Droid I wouldn't need to worry about this sort of attack.