Malware installed with remote debugging Is it possible for someone to install apks without you noticing, using remote debugging? (E.g. over TCP/IP, or on the same WiFi network). I found articles referring to this after a quick Google, but I'm not sure if they are not just alarmist.

EDIT: This paper seems to talk about something similar - "Android’s External Device Attack: Demonstration and Security
Suggestions" - Wei et al.

I was thinking of enabling debugging mode, but this is keeping me from doing it.
The attack (in question) mentioned in the said research paper would work on a device only when your device is running  ADB in TCP/IP mode. You have to specifically give the instructions to bind the ADB on a particular port on your device. 

Entering adb help would give one such entry:

adb tcpip &lt;port&gt;             - restarts the adbd daemon listening on TCP on the specified port


Until you restart ADB in TCP/IP mode you're safe from said network attacks (there would be no port opened by ADB to allow access to your device until restarted with aforesaid command).

For surety you can use an app like OS Monitor to see if there are any open ports on your device while running ADB over USB only.

You can enable USB debugging safely. However, other attacks like pushing malicious files or installing APKs et al would definitely work on ADB over USB, so be cautious while handing phones to others.