This is not a great substitute for installing through an app store because the app will not update automatically.

This is, however, a great thing to have.

A better substitute would be using F-Droid. By the way, some free software apps are not gratis on the Play Store but are on F-Droid.

It can still be confusing to manage two app stores for some people, while installing an app from a downloaded executable is usual on Windows, so Krita probably did the right thing.

What you say echoes my experience, I see a lot of apps on the Play store say "pay 1.99 here or get it for free on F-Droid", which is fair. I usually even pay the money even though I have F-Droid installed, just to support the dev.

Good question: why is Krita not on F-Droid? Probably a matter of time and effort, not a technical reason. I guess they sensibly got into the most visible marketplaces first.

Exactly, it is on our plans, would take a bit of time.

You forgot, and the users probably will forget too, to flip the switch back so that the browser is no longer a trusted source. That is, you've now increased the chance of malware being accidentally installed through the browser, since AFAIK Android will not prompt again until the switch is flipped back to "not allowed".

Android won't tell you again that the source is untrusted and will directly show the installation dialog, but it also won't silently install a random APK, so in practice the risk of accidentally installing malware is not that high unless you have very fat fingers.