Google can absolutely do this. Google's ability to do this isn't tied to an Android version. After being repeatedly hammered on support timelines, they started pushing functionality into Google Services (think the Play store, Google Play Services, and Google Services Framework)
Google Play Protect is one such service. One that Google tells you explitely can (has, and will) "deactivate or remove" apps from your device, sideloaded or not [0].
The only answer is a phone without Google Services. I don't mean "Don't sign into the Playstore", I mean deactivate (or flash a ROM without) every Google service - because who knows if it'll "accidentally" be turned on again
For the record, plugging into a PC and running a few ADB commands allowed me to disable every Google App (including system apps) on my KeyOne - even the ones that had "Disable" greyed out in the UI.
Start here [0], though I typically verify the device has ADB enabled (under developer options), is allowed to connect via ADB ("Trust this PC" when connecting/running the first ADB command), and recognized (adb devices). Then drop into the shell (adb shell) to issue the removal commands (pm disable $package), and search for more apps I don't want (pm list packages|grep google)
Drop me a line if you're after more specifics for the walkthrough, I'm always happy to help others get further from Google. Otherwise, note that this is only ever disabling apps - you're able to re-enable them, or a factory reset will bring them back as well. Nothing you're doing can even soft-brick your phone.
Google Play Protect is one such service. One that Google tells you explitely can (has, and will) "deactivate or remove" apps from your device, sideloaded or not [0].
The only answer is a phone without Google Services. I don't mean "Don't sign into the Playstore", I mean deactivate (or flash a ROM without) every Google service - because who knows if it'll "accidentally" be turned on again
[0] https://support.google.com/googleplay/answer/2812853?hl=en