This is standard practice. Most SaaS IT departments negotiate big rebates in exchange for long term commitments, and those who don't are leaving money on the table. I've seen datacenter deals over 10 years that looked far worse.
Anyone who has managed a product security program will tell you that's it's impossible for small groups to keep up with the complexity and attack surface of products like android.
From a consumer perspective, going with A and trusting the company is by far the safest option.
APK is an antiquated format that originates from Java Jar over two decades ago. It's basically a zip file with some internal structure for signing a manifest of hashes. Google already had to bastardize the APK format to move the signature to ZIP metadata, but there were still tons of problems around key rotation and distribution of large APKs.
This is a natural evolution of the format. It's good for the ecosystem. Whatever guarantees were supposedly provided by having developer (poorly) store their own signing keys are better handled by Google's own infrastructure.