I’ve seen public transportation apps doing that to curb sharing the ticket/barcode with someone else.

Yeah, because books, the web, and educated people have a liberal bias.

Some developers will publish their apps on github, you can download it, and use a different app to get the apk file from the app you get from the play store, and compare the hash of the file. If they’re identical then Google didn’t meddle with it. If they’re not, either Google did, or the developer releases a different version to Google Play.

Google playstore does not inject data in app packaging because it doesn’t own the signature key. F-Droid, however, does. I mean, they own the signature, but they do not inject or modify apps. They could, though.