Hours was hyperbole as I actually don't even bother to clean the device and just recommend getting a used iPhone and help them migrate the data, but technically cleaning a device after malware would've involved backing everything up, resetting the device, potentially updating the firmware (or installing a trusted third-party ROM like Lineage) and then reinstalling & configuring all the apps & accounts - I can easily imagine this taking hours especially on a slow internet connection.
I don't think it has anything to do with getting your apps from Play Store vs elsewhere. This is in the UK and despite Google Play being available, back when I worked in a phone store, customers bringing compromised Android devices was fairly common (in fact some of them didn't realize the bullshit ads or spam on their lockscreen/notifications was malware, they thought it was just normal and accepted it), and that was only the stuff I could see - technically there could be plenty more malware that chooses to remain stealthy.
I don't think it has anything to do with getting your apps from Play Store vs elsewhere. This is in the UK and despite Google Play being available, back when I worked in a phone store, customers bringing compromised Android devices was fairly common (in fact some of them didn't realize the bullshit ads or spam on their lockscreen/notifications was malware, they thought it was just normal and accepted it), and that was only the stuff I could see - technically there could be plenty more malware that chooses to remain stealthy.