Recent AOSP repo added lines of code to Package Installer to handle enforcing restricting whether Package Installer installs an APK file or not based on dev signatures, as well as denying installation if internet isn't available so it can't contact Google's servers for dev signature verification.

So this is enforced by Package Installer, which is already how Google enforces their ridiculous minimal SDK version requirement for installing APK packages, as well as for blocking app update with an APK package with mismatched signature or blocking downgrading an existing app with an APK package, which I already have bypassed via Xposed this way.

Besides, rooting gives YOU total control over your own device like when you have sudo on Linux, even if Google tries some new BS there will be a way to counter it when you have root