I wanna preface this by saying that I run GrapheneOS (GOS), so idk if that has anything to do with the fact that nothing has flagged my version of KDE Connect. If it’s a Google Play Services (GPS) thing, then:

1. I guess it depends on whether you run GPS on your GOS phone, or
2. Maybe it doesn’t even depend on #1, since GPS runs as unprivileged. I put KDE it on my GPS profile, and didn’t get any notification about this.

Guessing this is just a Play Protect thing.

Nevertheless, if you’re installing FOSS apps, try installing them via Obtanium instead of the Google Play Store.

You can simply copy and paste the source code URL into Obtanium, and it’ll grab the APK, as well as notify you when there’s updates.

It supports F-Droid, GitHub, GitLab, and other sources.