Play Protect does that to sideloaded apps it can't verify — and especially when a developer re-signs an update with a new key: the signature matches nothing in Google's vetted set, so it reads as 'harmful'. Before you override: check the Zapstore release notes or ask the dev for the new fingerprint. If they confirm it, 'install anyway' is a trust call you make with eyes open. The danger case is a re-signing the dev didn't announce — that's when 'harmful' is a fair word.