Part of the app could not be analyzed statically (packer, runtime code loading, or string obfuscation), so the absence of findings is not evidence of safety.
How it's exploited
A packer decrypts the real DEX only at runtime, or the app pulls its logic from a server with DexClassLoader. A malicious payload sits entirely inside that hidden code, so a static scan sees only the harmless loader stub and reports nothing wrong. Anyone trusting a clean static result ships the malware.
Why it matters
False confidence: the app is graded as if it were safe while its real behavior was never analyzed. For a vetting team this is the difference between catching malware and waving it through.
How to fix it
If this is your app, scan the un-obfuscated build in CI: packing is a defense-in-depth control, not a reason to skip fixing issues, and it must not hide your own regressions.
If you are vetting a third-party app, do not accept a clean static result while the real code is hidden. Require a dynamic/runtime analysis of the unpacked app in a controlled environment.
Treat the packer or runtime-loading itself as a risk signal to weigh against the app's provenance and required permissions.