They
could do lots of things, but absent any evidence that they're
likely to, it's just wild speculation.
And it's not "sideloading." There's no other local device involved. Once you've flipped the "unknown sources" switch, you just go to a website, download, and install, same as you would on a desktop.
