Spotify app is OK. I can listen to music on background with no problems. You said you listen to obscure songs, Spotify is lacking in that regard and YTM has the best library.
WSL: If your friend is a dev and needs Linux cli utilities, use this.
Dual Boot: If your friend wants to daily drive Linux, use this. Shrink Windows NTFS partition within Windows then install Linux to blank space.
Virtualbox: Testing ground for dual boot, your friend can familiarise themselves with Linux safely using a VM.
Meanwhile I mount the ISO, copy paste its contents to a ~150 GiB FAT32 partition on my HDD I used for backing up PS3 and then modify grub.cfg so GRUB can pass the correct arguments to Linux kernel.
be it as something modified and distributed on a unsanctioned channel
Downloading APKs from reputable sources and signature checking can help with this one. Android will refuse to upgrade an app if APK has a different signature anyways.
custom injected by another malicious actor/app
If this is possible there are bigger problems.
Multiplayer game operators have obligation to curb modified clients so their actual paying clients have a levelled playing field.
I have 8723be, not only it randomly disconnects but also it sometimes drops to 30 KB/s requiring a reconnect and has bad signal reception even on Windows.
Ethernet 4 life.
Why do you think apps should verify their integrity in the first place? In the case of banking apps or other online apps, the APIs they use should be secure in the first place so a user can't achieve anything meaningful by modifying API calls. In the case of offline games with monetization, a hacker who makes a pirated APK will also remove the restriction so legitimate players on non standart ROMs will get screwed. In the case of messaging apps with a "delete messages" or "one time view" function ie. Whatsapp, the sender shouldn't take that their actions will be respected by other clients because modded apps exist and Whatsapp doesn't care if you install it on a rooted device.
APKs are signed, you can verify the integrity of an APK. If you have a previous version of an app installed, a new version with incorrect signature won't even install.
CabbagePepper on top left