How those phishing apps are even allowed into the store in a first place, don't they have to get some sort of ok from the playstore before being published?
This is the most important question about how these apps are approved in the Play Store. Google itself may not be well aware of how scammers fool Google's verification system and upload these apps to the Play Store. Google takes action only when the community reports on that app, then Google deletes that app from the Playstore.
So before installing any app should be checked, if you hurry, there is a chance to fall into the trap of this type of app.