Can an app installed from the Google Playstore install another app with different permissions? I installed an app for custom notifications from the Playstore. The app requires sensitive permissions (camera, contacts, and storage), but has no network access. When I selected a setting the app said I needed to install another app and then my phone displayed a window prompt asking if I will install an app from an untrusted source. My concern is if this app could be spyware with internet access to steal my data. Is this possible if the main app has no network access and no downloading permissions?
I contacted the developer and they told me that particular setting requires an &quot;older API level&quot; that is not possible for main apps to have. I am not knowledgeable enough to know if this is a valid reason.
It's not common but it's not unusual either. I use this MacroDroid automation app. It requires a helper app that can't be published on Play Store and therefore developer provides a link to download, with this explanation:

In order to toggle Wifi on devices running Android 10+ a new helper file is now required. This helper file is built against an older target SDK allowing it to still invoke the Wifi functionality. It cannot appear on the Play Store since they no longer allow apps built against older SDKs to be uploaded.

When a WiFi toggle action is triggered, the installed app (from Play Store) sends an intent to this helper app, thereby circumventing Android 10+ restrictions. So it's a win - win for all because the app functionality is not degraded.
So, if you trust the developer and are sure you need that additional app, you can go ahead. As an added precaution, download the apk and examine it's permissions before installing (Mixplorer does that).