Actually, alternative app stores can make use of that as well. The installer app needs to be installed as a system app with proper permissions, and it will them be able to background install apps on demand just like Google play does. The F-Droid Privileged Extension[0] does just that. While you need to be rooted to add/register such apps, that's not a problem for device manufacturers.
If you open an APK it prompts you to go right to Settings and enable it. Actually easier than installing Firefox on a brand new Windows Surface, which requires an MS account to enable unknown app sources.