If you are a software company, like valve, but to publish phone app. They have to go through Google store since that's how you get that "verified" thing and you don't have to enable developer mode. And for user that's a peace of mind.

Is there a phishing website on PC, yeah, and how do you know? Usually it's going through search engine or your bookmark and then check the HTTPS icons on your browser. There are also signed cert if you download and the windows exe launcher will check that with 3rd party cert. These alternative methods are not readily available on a phone, and that's intentionally implemented so software developer will funnel back to the play store.