why is protection from malicious apps from the play store being performed on the phone instead of in the store?

Because it’s behavior-based. You can’t tell how software will behave until you run it. And running it means having real human interactions with the software and the environment on your phone. It’s literally impossible to predict what software will do just by reading the code. It’s the Halting Problem. I’m no expert though, and I’m kind of assuming.

And I’m sure that some exploits are detected in the source code by the Play Store when they’re done naively and obiviously.