Okay but, installing an apk is not the kind of thing a scammer does. They'll just install some standard off the shelf remote access software from the play store

This very much feels like they just needed to come up with a new justification for this process and opted for scammers for some reason. Even though they're completely disconnected