No, it is not a bug. Android is made by Google, and Android has a detection feature that detects when a brand new app that isn’t uploaded to Google Play yet exists. As long as your app is really not a virus (I’m just saying if you make a virus you are a terrible person) just send it to scanning, this way Google won’t do the same check on all of the phones where the app is being installed on. Those scans are made so Google Play can see your app coming from a mile away and if it’s a virus they will just get rid of it and also send it to research to make protection features against your app for all the phones running Android and Play Protect. So yea, there isn’t much to worry about, just make sure you have no malicious content inside of it. Good luck!
No, they will recheck the .aab file you provide them again for compatibility with all of the systems you have agreed to publish for when you upload a new version on the console. I’m talking about malicious content a lot since you could mistakenly download a bad extension and not realize it. Getting banned from the Google Play Console isn’t a good start. In that case, 25$ would be the least of your concerns.
EDIT: Just mentioning one thing, never trust Play Protect, it sucks so bad and it can be easily tricked, if you think an app you’re downloading might contain a virus just get an antivirus or change your mind. It’s very easy to have databases that send data afterward and infect your phone. Also, the testing that is done on your app when it’s getting examined is just some random phones controlled by bots and they are tapping every single component on your app. You will receive videos of the testing and a fun fact: at one of my apps a bot just went on an ad by mistake and browsed an entire website that had those cringe online games.
I didn’t use the download component yet, but it might be because it cannot connect to Kodular servers so yes, it is a bug.
EDIT: Try uploading the app to your preferred marketplace and see if it works when you download it from there, it might be something related to publishing idk, but it’s worth trying if you upload it anyways.