You can make mistakes with both. The Google play store regularly hosts fake and malicious apps which are disguised as the real thing which you can accidentally download. Similarly, there are plenty of fake websites designed to trick you in to downloading fake apps, and these websites will also appear on Google search results. You should never trust an app just because it came from a specific source or what you believe was the legitimate website. Even if it did, websites and servers can be hacked and have the real files replaced with malicious ones.
The correct way to ensure your safety is to verify the download against the PGP signatures of the developers or the provided hashes prior to installing. You should download the software in question from the official site on your desktop or laptop, verify the file you have downloaded, and then transfer it to your phone to be installed.
Out of them most obvious ones are the mining pool apps or cloud storage apps that makes you fool and hack your system then which is far more dangerous than we think.Some of them are here :
Fake apps on Android
There are fake one's on IOS too and one famous was Trezor app that presented to be the legit one hardware wallet app but in actual it was scam and only one user was unlucky to fall victim of that scam and he commented out that :
Quote
Christodoulou isn't the only person to fall victim to the scam; Georgia resident James Fajcz also told the outlet that he lost $14,000 worth of Bitcoin and Ethereum to the fake app.
So people need to have an extra security measures as you have mentioned and verify the softwares before installing them in your system which will protect you from any kind of big scam.