Yes. Third-party APKs can harvest sensitive info (bank details, location) or track behavior via embedded analytics/trackers.