This is truly such a bad bug very unacceptable

It's a feature until someone misuses it. Publishing with zsp shows terms you're agreeing to and walks through steps. Having users able to search repos and have them come up is cool, but maybe some kind of confirmation showing what it does would be helpful, to prevent these unintentional ones, and warn malicious ones. It still shows who published yours - I can see both versions on mine. And if the APK's are the same, I can see how it would show both as installed... Though that is confusing. People aren't used to freedom and the responsibility that goes with it. But it's worth building!