This situation seems insane.

TL;DR: install Termux from FDroid or GitHub. The version on Play, whilst claiming to be the latest version, is built by someone else from an old version.

Not just someone, but the original author.

Not sure if that makes it worse.

The situation is actually not that bad - see https://www.reddit.com/r/termux/comments/1dbujal/information... for more follow-up information.

TL;DR: Termux is coming back to Google Play! While it's currently missing some features and have some rough edges due to more restrictive Google Play requirements and feedback from the review process, it will be fleshed out over time.

By complete chance yesterday I decided to manually update my apps - I normally just let them go whenever in the background

I happened to run into this! Having not actually used Termux in months... I just removed it.

Yet another retroactive Trojan horse, huh? A play at monetizing a conflated name. This garbage is why I don't engage with the ecosystem any more than required