Shopify is using the GA4 Measurement Protocol to send shopify_app_install events.
This problem occurs because ga_session_id, which is being sent to GA4 Measurement Protocol, is not the same as the user session ID. I recorded a video to show this problem.
Google updated their cookie format in May which is possibly the main reason behind the skewed attribution. With the format change, critical Measurement Protocol integrations stopped working because they were retrieving malformed IDs. Any server-triggered event that relied on the old cookie format must be updated, or those events will not be attributed correctly (or may be rejected by GA4). Shopify team needs to alter and recognise the new GS2 format which is now prefixed and with a dollar-sign ($) separated. And, session IDs include a prefix with the character "s“.