How do they get 100 million people to install that kind of crap anyway? Is it perhaps preinstalled or is there another scam going on with fake installs?

Most likely fake installs. It would be better if Google showed active users in last week or something similar.

GO apps were really popular, I remember installing some during the Cheetah Mobile Clean Master days. Not sure if still that's the case but it's popular enough to show on top on Play Store searches and it has attractive screenshots.

That was a good keyboard before Gboard got better with swipe.

How apps like this pass moderation in Google Play? Wondering if App Store moderation is any better.

No.

Would that site's analysis be able to detect if they did something beyond just metadata type stuff?

Like, does it just profile and track you, or could they actually steal passwords and trade secrets and the like?