jackFang
How would that happen? Depends if a developer of a particular app got compromised, or handed it over
the repository to a 3d party. Those are different cases . Already happened with "Simple Mobile Tools" suite:
https://github.com/SimpleMobileTools/General-Discussion/issues/241
A fork came a month later, but that's not the scope of the question.
When it happens to a popular project, the community on Github might respond to it quicker.
I don't see how F-Droid will push an update to blacklist a 3d party repository. They do build the project
on their obscure build systems hosted on Hetzner which adds another potential 3d party. I do see how Obtanium
will possibly take this route in order to protect users. The F-Droid project is just a stagnating, "too big
to fail" thing from the early 2010s and many things changed since then.
Personally when I see the donate button on their site I know they will never run out of resources, just because people trust them historically, without apparent reason to do so, they were never transparent about their project.