that seems to me to be the only practical way of implementing this law, and it's still hardly practical.

is been years since I've worked with Apple stuff, so not sure about that, but with Android, pushing an update to an app relies on individual user's consent (ie: either manually triggering an update or being dumb enough to leave auto updates switched on).

To get a compromised binary literally pushed down without user involvement you need to get it on Google's 'critical updates' list for the operating system. That's a bit of a hurdle, but given Google's quick willingness to breach their own "don't be evil" principles to do business in China (cf. project butterfly), I doubt it's an insurmountable one.