Watermelon Yeah but whereas it's only theoretical on other app stores, on F-Droid it's a real issue.
Google Play also signs app updates themselves. It is not more of a real issue with F-Droid than it is with Google Play. And it is not a real issue with either, as it never happened as far as I know.
F-Droid has issues, but please do not spread fear around F-Droid for things that actually aren't issues.
Watermelon How do we know?
I didn't say there are no malware on F-Droid, I said there are no known malware on F-Droid. There also are no known malware on Google Play. A lot of malware has been found on Google Play, and removed, over the years. F-Droid too would promptly remove any malware that is on there that gets discovered.
So, there is no known malware on F-Droid. We don't know about any.
This is totally unlike how it is for the rest of the internet, like if you install APK files manually. The rest of the internet is not curated in the sense that F-Droid and Google Play are, malware on the general internet does not get removed.
Watermelon With manual APK installation, only the initial installation is risky,
No. App updates are still at least as risky as it would be if installed from app stores. Individual devs usually do not have very secured build environments. Complaining about F-Droid not having secure build environment and then recommending to install apps directly from individual developers instead is hypocritical. F-Droid might not have very good build environment security, but at least that is something they consider at all, unlike what the individual developer who builds things on their own totally insecure machine would, where the signing keys are often stored unprotected on disk on the same computer.
Watermelon if you consider HTTPS security risky
The risk is not having your HTTPS connections compromised. The risk is judging what even is the legitimate source for an app. I bet most who install apps manually just does an internet search for the app name, and install from the first site or github repository that "looks" genuine. Unlike app stores who specifically try to ensure all apps are legitimate, search engines do not care about that at all, just what sites are popular.