Solely relying on the fact that a download is coming from a specific site, or that it has the Google Play store "tick", is simply not good enough. Sites can be hacked. Google accounts responsible for uploading updates can be hacked. The Google Play store does minimal due diligence and can assign the "tick" to the wrong app. If you download without verifying, regardless of where you download it from or who recommends it, then you are by definition trusting, and not verifying. As I said above, you should download the app from Electrum.org on your computer and verify it before transferring it to your phone.

Although I only store daily spending money which I can afford to lose in a mobile wallet, I would still say it is significantly safer and more secure than any third party custodial wallet.

They don't need to copy the whole app, though. All they need is a convincing looking log in screen and a back end to send whatever username and password is entered on that screen to the attacker, perhaps followed by a "Servers busy, try again later" warning to not make it immediately obvious that something is wrong. Even something a simple as that is more than capable of stealing log in details. You don't need to copy the whole wallet functions, trading functions, etc. You just need enough to convince people to try to log in.

But similarly, there are a bunch of fake Coinbase apps, Binance apps, or apps for other custodial services. There are also a bunch of fake websites for all these services. And fake emails. And fake social media accounts. And so on. People will always be exposed to potential scams. Better in my opinion to use a wallet like Electrum where you can verify with certainty you are using the real one.