I think you have just a security notification through your phone. Some android phone gives the user a notification that indicated the allowed resources or etc. Maybe, you just need to click yes because this app is not spy and it may not harm us since they need users. Thank you for being cautious.
Yes, I also think the same as you but in my previous reply is that I did not point out the possible reason about why it is considered as harmful to his/her device. One thing i'm sure is that he/she has a settings setup my google play store or his/her phone about the file he/she will download. I do experience like that before. Anyway, google playstore has Play Protect that will automatic scan the app you downloaded from playstore but in Appstore I don't know of they have same feature that will scan apps when downloaded.