While it is scary, users can avoid them as long as they are careful. Most malware distributions come from malicious apps, not to mention Google's security system is just terrible at filtering them. If you want to download a new app/wallet, verifying your app on the official website or distribution channel is a must these days.
Certainly do not install applications obtained from the black market or third-party websites.
But even so, this Xenomorph malware acts as a trojan that hides in applications that look legitimate to use.
Therefore, Google Protect did not detect it because the attack used was relatively new.
But now Google Protect and several other antiviruses have made security improvements for the Xenomorph Malware type.
Also, pay attention to the permissions that will be requested by the application to be installed.
If the permissions ask for personal access such as SMS permissions, telephone, data access, camera, and other crucial access it is worth being suspicious.