I'm curious about what you mean by the issue with Android's security model. Apps can have whatever package name they want (... Well, I am sure you can't publish a com.google
package on the Play Store) so that doesn't make sense.
The only thing I can imagine you're referring to is data sharing between applications signed with the same key, but that's not the package name.
Absolutely, yep! I curse myself every time I just click "extract" forgetting that other file managers don't do this, and end up with files all over the place