I'd think so. Most app developers expect some return for their time, so "free" is rarely free. The payment may take the form of ads, or it may take other forms, from the legitimate (in-app purchases to unlock more useful features) to the less so (selling your personal information to spammers - the business model of several big Chinese developers, and the reason most of us will never install an app from a company with "Cheetah" in the name). So if there's funny business possibly associated with a free app it's fair to question how "free" it is.
That said, I've been using android for a decade without ever encountering DCB, so being wary of the Play Store is going too far. Being careful what you install is sensible, but that's true wherever you install from, and more important with most alternative sources of apps. As for locked down, at least you can choose to install apps from elsewhere, unlike the other main mobile OS.
Back on topic, do you know that it was this app responsible? You didn't use a phone to pay for car parking, accidentally subscribe to some ringtone service (that used to be a scam here in the UK), etc? Since it's direct carrier billing maybe you could contact them and see whether they can tell you what it is and who it is from (if there is a connection to the app there then you will know it was them)?
