They are probably using certain flags to determine potential or likely maliciousness. I doubt this is as insidious as some of you are making it. Don't use Play Protect if this is really that big of a problem. Systems like this will never be perfect in a world with so many applications and bad actors. Some good software will inevitably be caught up in the net like this. 

 I didn't say it was harmful. The more important question is why use Play Protect at all if your philosophy is that any app you allow to be installed is safe and should therefore remain? Things like PP aren't designed for people who know what they're doing. It's a lowest common denominator system designed to technological morons who may be tricked into installing things outside of Play. I'm merely speculating that RS could be meeting some arbitrary standard that unsafe apps commonly meet in the eyes of Google.

Google can't be expected to analyze every app closely after every update to avoid ever having a false positive. It's much easier to just play it safe and remove apps that don't meet their definition of safe. Like it or not, a Bitcoin trading app installed outside of Play probably isn't something their average users are installing.

I've also stated that users SHOULD be able to disable this if they really want to. This default behaviour probably is safer for the average stock Android user, even if some apps end up getting falsely accused and removed. Even being advanced enough to discuss this issue indicates that you just shouldn't use systems like that in the first place. It wasn't made for people like us.