Google blocked 2.36 million untrusted apps from reaching Android, yet risks remain