I installed an app for custom notifications from the Playstore. The app requires sensitive permissions (camera, contacts, and storage), but has no network access. When I selected a setting the app said I needed to install another app and then my phone displayed a window prompt asking if I will install an app from an untrusted source. My concern is if this app could be spyware with internet access to steal my data. Is this possible if the main app has no network access and no downloading permissions?
I contacted the developer and they told me that particular setting requires an "older API level" that is not possible for main apps to have. I am not knowledgeable enough to know if this is a valid reason.