APK vs AAB
Both formats are protected, but a few behaviours — like integrity checks — differ.
Both are supported
Upload an APK and you get an APK; upload an AAB and you get an AAB. Packing & encryption, native obfuscation, string/code obfuscation, RASP and monitoring all apply to both.
Self-checksum is APK-only
Because Play re-splits an AAB into per-device APKs, an in-APK checksum manifest can't predict the split structure. So the self-checksum tamper check is supported only for APK input.
For AAB, rely on Play App Signing for integrity — it verifies the signature server-side across splits.