False alert in permission check about qark HOT 1 CLOSED

I believe you misunderstood the output. The vulnerability alerts precede the components which are impacted. The full output is below:

POTENTIAL VULNERABILITY - The following activity are exported and protected by a permission, but the permission can be obtained by malicious apps installed prior to this one. More info: https://github.com/commonsguy/cwac-security/blob/master/PERMS.md. Failing to protect activity could leave them vulnerable to attack by malicious apps. The activity should be reviewed for vulnerabilities, such as injection and information leakage.
example.com.permissioncheckbug.TestPermissionActivity
example.com.permissioncheckbug.PermissionControl
WARNING - The following activity are exported, but not protected by any permissions. Failing to protect activity could leave them vulnerable to attack by malicious apps. The activity should be reviewed for vulnerabilities, such as injection and information leakage.
example.com.permissioncheckbug.MainActivity

This saying that an app installed before this one, on older versions of Android, can bypass the permission protection.

POTENTIAL VULNERABILITY - The following activity are exported and protected by a permission, but the permission can be obtained by malicious apps installed prior to this one. More info: https://github.com/commonsguy/cwac-security/blob/master/PERMS.md. Failing to protect activity could leave them vulnerable to attack by malicious apps. The activity should be reviewed for vulnerabilities, such as injection and information leakage.
example.com.permissioncheckbug.TestPermissionActivity
example.com.permissioncheckbug.PermissionControl

This is warning that the MainActivity is not protected by permissions:

WARNING - The following activity are exported, but not protected by any permissions. Failing to protect activity could leave them vulnerable to attack by malicious apps. The activity should be reviewed for vulnerabilities, such as injection and information leakage.
example.com.permissioncheckbug.MainActivity

from qark.