What if the developer install malware on their new update.(lets say they make new update on 15 JAN)
Quite difficult to do due to the slightly better privacy features of newer Android and iOS operating systems. But it's definitely possible and definitely a risk.
Being open sources software wont allow other users to see if its infected i believe.
Of course. Not every user can verify source code. But it only takes one or a few developers to see the bug/malicious code and publicize it to get people to stray away from the software.
what of millions of people will download their app then they could take the funds of the users?
They could. Hence why a wallet being open source is very important.