However, this hack could have happened whether sideloading was allowed or not.
In fact, following the OP's link to https://citizenlab.ca/research/how-discover-tech-turned-targ..., "the company’s ads were shown on almost 200,000 unique websites and Android/iOS apps in dozens of countries" so it's not just apps but ordinary websites you visit in your android chrome browser.
So there's some sort of Android/iOS vulnerability in Chrome/Safari that they're exploiting?
No info on if a recent version patches this?
It also mentions a "Windows DLL" - so they're somehow infecting Windows desktop too?
Yes, Google's move to block people from installing software on their own devices is orthogonal to this. I was merely saying that some measures have massive negative effects and basically irrelevant positive effects in the grand scheme of things.