By default, Play Protect will scan every single app installed on the device at regular intervals to ensure app updates aren’t used to infiltrate malware into your Android operating system. It also scans all-new app installs originating from the Play Store, as well as those from third-party sources.
In 2017, Google revealed its Play Protect service scanned 50 billion apps a day. By November 2018, Google launched a major upgrade to the Play Protect service that enhanced its database of known malware samples.
In order to ensure the database is always up-to-date, Google proactively scans the entire internet for Android installer files – known as APKs – to file and index all malicious apps in the wild.
This is a much more effective system than waiting until users accidentally stumble across nefarious apps before cataloguing them – like it did with the original iteration of Play Protect.