I don’t agree with your “only download from official stores” stance. The last several malwares we got were from the official ms or android stores. These places offer a false sense of security, and like downloading an app from a seemingly trusted website, the app should be placed under high scrutiny. Scan everything before you execute it, and have a heuristic antimalware running. Use good cyberhygiene, and you can download from anywhere and, while it’ll never be 0, your risk of infection will be significantly lower than those who blindly trust the official app stores.