Doesn't play protect just keep you from installing malware? I have issues with Google the same as everyone else. That being said, I feel like it makes sense to protect old people from getting a call with step by step instructions to install malware. It seems to me that it would take a sufficiently advanced user to be justified in wanting to disable Play Protect. In that case, they're advanced enough that they don't need to receive instructions over the phone and can say "I'll call you back after I finish this"
why is protection from malicious apps from the play store being performed on the phone instead of in the store?
Because it's behavior-based. You can't tell how software will behave until you run it. And running it means having real human interactions with the software and the environment on your phone. It's literally impossible to predict what software will do just by reading the code. It's the Halting Problem. I'm no expert though, and I'm kind of assuming.
And I'm sure that some exploits are detected in the source code by the Play Store when they're done naively and obiviously.