Plenty of capable web developers can build software. Fewer know how Shopify apps authenticate, request permissions, bill merchants and pass review.
Ask for an app you can install. Screenshots of an admin screen prove little. A public app they built has a listing and reviews you can read, and a custom app can be demonstrated on a development store. If they have neither, you would be funding their first Shopify app.
Ask which permissions the app will request. Apps ask for access scopes, such as reading orders or writing products. A developer who requests only what the feature needs is thinking about your data; one who asks for everything, just in case, is not.
Get hosting and monitoring in writing. Every app runs on a server someone pays for. Find out the monthly hosting cost, whose account it sits in, and how you'll know when a job fails. An unmonitored app tends to fail quietly, often in the middle of a sale.
Settle ownership before the build starts. For a custom app, the code belongs in your repository and the app should sit under an account you control or can have transferred. For a public app, whoever owns the Partner account behind the listing receives the revenue, so make sure that is you.
Red flags. A public app quote with no time for App Store review or for Shopify's mandatory privacy webhooks (the handlers that deal with customer data requests and deletions). A fixed price for a large app with no discovery phase. No plan for who maintains the app after launch.