

I get very far by just keeping a set of folders for each piece of equipment in a git repo.
Pictures, etc, and sometimes the PDF manual if I bother.
The difficult part here is being consistent over time - making sure you mark down when you bought things, serial numbers, etc. a proper website/app will force you to do this, but there is flexibility in having whatever convention you like most
Source: worked on something similar a long time ago
Likely hash based scanning like most virus scanners. It will have a set of signatures for various types of malware (keyloggers, local DNS servers, etc), and looks through the apk (which is just a zip file) for things it knows are bad like financial malware added to the app.
Their process for adding signatures to their database and how they label them is fully opaque and completely up to them, like any other antivirus company. So they could incorrectly label things intentionally and you’d have no way to know.
given your device is now compromised you should probably get a new one unless you trust android is able to fully remove the app. Because some financial malware will intercept 2fa sms from your bank.