Many repacks are distributed via "link shorteners" that pay the uploader per click. To get the file, you must complete surveys, enter your phone number, or download a "download manager" that is actually spyware. By the time you get the broken APK, you have already lost your privacy.
The first few links were graveyards of pop-up ads and "Allow Notifications" prompts. Finally, he found it on a shady mirror site. The file was small, suspiciously small, but the description promised "Premium Unlocked - No License Needed." He side-loaded the APK using his computer, ignoring the red warning text from his developer software.