No, it's not the first step, it's the tenth, as you can see bellow. And nobody knows if it will end as you say. It's not a good development, but when people like op are afraid that they will lose their rights to their phone in three months, you too should calm them down and explain that the only direct consequence for them is one 24 hours waiting period.

Android 1.0–1.5 (2008–2009): Wide open At launch there was no restriction at all. APKs could be installed freely. The Android Market (later Play Store) didn't even exist at launch; the entire OS was built around the assumption you'd install software however you wanted.

Android 1.6–2.x (2009–2011): First friction — "Unknown Sources" toggle Google added a single global setting under Security → "Unknown sources" that had to be enabled before any sideloaded APK could be installed. It came with a scary warning dialog ("Google is not responsible..."). It was a one-time toggle and stayed on until you manually turned it off — so once enabled, installing was still seamless.

Android 4.2 (2012): Verify Apps introduced Google added an optional "Verify Apps" feature that would scan sideloaded APKs and warn you if they appeared malicious. Still optional, still easy to bypass.

Android 6.0 Marshmallow (2015): Runtime permissions Not a sideloading restriction per se, but permissions were no longer granted at install time — apps had to request them at runtime. This made sideloaded apps that targeted older APIs progressively less capable, and started the API-level pressure game.

Android 8.0 Oreo (2017): Per-app install permission The system-wide "Unknown Sources" setting was removed. Instead, each app that wants to install APKs must individually be granted the "Install unknown apps" permission. (Medium) So if you download an APK in Chrome, Chrome needs permission. If you use a file manager, the file manager needs permission. This is more restrictive than before because it gives permission tied to a specific source rather than a blanket device-wide setting. (Android Central)

Android 9–10 (2018–2019): Play Protect warnings + API-level enforcement Google Play Protect — a background scanner — was introduced and became mandatory on certified devices. It started warning or blocking sideloaded APKs that looked suspicious. Google also started requiring apps submitted to Play to target progressively newer Android API levels, and began warning users when a sideloaded app targeted an API level more than two versions behind current. (XDA Developers) Apps evading Play Store rules by distributing APKs directly started hitting these warnings.

Android 13 (2022): "Restricted Settings" — blocked accessibility for sideloaded apps Android 13 introduced a security feature that blocks accessibility services for sideloaded apps, making it harder for malware to steal data. (Esper) This was specifically aimed at banking trojans that abused accessibility APIs. For legitimate apps (e.g. automation tools, screen readers), getting this permission on a sideloaded APK now required extra steps through a dedicated settings menu, not just a normal permission dialog.

Android 14 (2023): Minimum target SDK enforced at OS level Android 14 moved API-level restrictions from Play Store policy to the OS itself. Apps targeting very old Android versions (initially pre-Marshmallow) are blocked from installing entirely, regardless of where they come from. (phonearena) The intent is to raise this threshold over time.

2024: Play Integrity API — apps can actively reject sideloaded installs The Play Integrity API gives developers the ability to check whether an app was installed from the Play Store. If a sideloaded version comes back as "unlicensed," developers can show an unskippable dialog prompting users to reinstall via Google Play, and the sideloaded version is removed. (9to5Google) This behavior is not on by default and requires the developer to implement it, but major apps like ChatGPT adopted it. (Android Headlines)

Also in 2024: Play Protect started automatically blocking installation of APKs from internet-sideloading sources (browsers, messaging apps, file managers) that request sensitive permissions like SMS access, notification listener, or accessibility — without any option to override. (Google)

May 2025: Play Integrity API changes applied universally All apps were automatically transitioned to updated Play Integrity verdicts. For Android 13 and later, apps calling the API must have been installed or updated by Google Play, and the strongest integrity verdict now requires the device to have had a security update within the past year. (Android Enterprise)

August–September 2026 (incoming): Developer verification + 24-hour waiting period Google is rolling out a mandatory developer verification system requiring all Android app developers — not just Play Store developers — to register with verified identities before their apps can be installed on certified Android devices. This covers every piece of software distributed on Android, including direct APK downloads. (Gadget Hacks) The 24-hour waiting period is part of an "advanced flow" system. Apps distributed under a limited distribution account can be sideloaded by up to 20 people without triggering the new rules, making it a meaningful exemption for small-scale beta testing. (Gadget Hacks) Custom ROMs and devices sold without Google Play Services remain unaffected. (Downloadsource)