Some Android phones does that when downloading apk outside of Playstore and most of them will warn you when side-loading apps.

The question is if you've tried to download the legit app.
But that's not something that you can verify since they do not provide pgp signature alongside the download
And didn't mention the developers who compiled the app who should've provided the signatures. It's all about trust for custodial services.

All you can do is to trust their website's server.