Google protect do already verify it if the app is safe or not before installing.
He never mentioned google play in the first place, so why are you assuming that he has not downloaded the APK file from somewhere else?
Also automatic tools make mistakes as well, so your point is invalid as OP is clearly looking for someone to
analyze the APK instead.