Play Protect blocks malicious apps, not network traffic, so no, it obviously doesn't interfere with Google's apps.

AFAIK it also left SmartTube (an alternative YouTube client) alone until the developer got pwned and the app trojanized with this kind of SDK, and the clean versions are AFAIK again being left alone. No guarantee that it won't change in the future, of course, but so far they seem to not be abusing it.

Does malicious mean interfering with Google's business model, or does it include intrusive advertising?

Malicious here means "most people who aren't trying to argue semantics or otherwise be smartasses about it would consider it malware". That's why the example I gave is a semi-popular software the allows watching YouTube without ads without a premium subscription, i.e. at least in the case I observed, I don't believe this was weaponized against apps that interfere with their business model.

As for "intrusive advertising is malicious", see the second part of the first sentence.

I'm not being a smartass. Intrusive ads are malware. Adware used to be a category in virus scanners, then stopped when virus scanners wanted to run ads themselves.

Proxying traffic is not malware, since it doesn't affect me in any way.

malicious ≠ intrusive.

but intrusive advertising is malicious