Sideloading APKs from unverified sources can bypass Google Play Protect. Many modded apps collect your IMEI, contacts, or location data.