Apps may feature code that dynamically changes on your device and not show that behaviour until a while. That’s why play protect scans for malicious and may further block an app from functioning if it detects suspicious activity.