The libretro blog says that RetroArch 1.9.0 won’t be on Google Play because:
Issue: Violation of Malicious Behavior policy
An app distributed via Google Play […] may not download executable code (e.g. dex, JAR, .so files) from a source other than Google Play.
The thing that this article doesn’t mention though is that RetroArch downoads cores without any security whatsoever – plain HTTP and no digital signatures. And Android users are the lucky ones - they have sandboxing by default, unlike Windows and desktop Linux users. People love to complain about restrictive app store policies, but apparently they really are for our own good…