is it possible for someone to install apks without you noticing, using remote debugging?
Yes. First you have to have remote debugging (ADB over TCP/IP) on (typically requires root). Then they have to know your device's IP address and the port number used for ADB over TCP/IP. If done through a malicious app, you would have first had to install the app, and it would need to have a root privilege escalation method to work to enable adb debugging and adb over tcp/ip.
As of Android 4.2, there has been changes to how ADB works. It now requires device Authorization first, over usb. When connected to the right version ADB client, the phone prompts the user to accept the client device fingerprint. Until that happens, the device cannot connect over TCP/IP. After it is authorized once on usb, then it can work over TCP/IP.
Additionally, there is the Verify apps (under security) and Verify apps via ADB (under developer options). This sends details about sideloaded apps to Google for verification, and will block common malware from installing, even via ADB (if checked, naturally). It will not catch everything.
To mitigate this, you just need to follow a few common sense steps. First, use a SU manager, to prevent random root access. Second, keep ADB over TCP/IP disabled until needed. Third, keep Debugging or development disabled. Forth, be wary of any app outside of the Play store.
In short, its possible, but harder to happen since Android 4.2