Always scan downloaded .apk files. Community-vetted sources like those found on Reddit’s r/PicoPiracy are generally safer than random search engine results.
Tools like SideQuest or standard Android Debug Bridge (ADB) commands are used to "push" the APK and OBB files from a computer to the headset.