I’ll just point out this isn’t only an Android issue.
If there any IT person here who has had to direct an employee to download the Microsoft authenticator app from the iPhone App Store, you’ve almost certainly seen that it promotes a deceptively similar looking authenticator above the Microsoft one, and you have to make sure the user knows not to download it.