But the thing is that they are not really making Android more secure with this policy.

They are still allowing APKs signed with debug keys to work.. so the only alternative now for any developer that doesn't want to register with Google is gonna be using those debug credentials to sign their app releases.

This is not gonna stop rogue APKs from outside Google’s store, it’s just gonna make them less secure (since they'll have to rely on debug keys, which is essentially equivalent to being unsigned, from a security point of view).

This is not gonna stop alternative stores either, in fact, it will make it more important to use stores, since they might still be able to to implement alternative ways to check package authenticity before installing, even when using debug keys.

The issue with using debug keys is that you are now not gonna be able to shield apps signed this way from getting replaced by illegitimate malware you might download from outside the store. So overall, this move is making Android LESS secure, not more.