n3t_admin Obtainium has pretty much every single security problem/issue of Aurora - but on steroids.
That is a very bold claim which I don't think your following points support.
n3t_admin There are exactly 0 signature checks on first install
There are not much application checks done on Play Store either. At the end of the day you install almost the same app from Play Store as you would do With Obtainium. You can check the hash of the app on GitHub, you can also compare apk sign hashes to peers or App Verifier database. You need to trust the developer on some level. There is a reason there is still malware on the Play Store. With GitHub the advantage is that you can build the app yourself even reproducibly and verify it yourself with the source code if you really want to.
n3t_admin No auto-updates.
There are auto updates on Obtainium. Admittedly there are some apps which don't always receive proper updates if there are multiple .apk versions but you can filter those out with regex.
n3t_admin Issue of trusting that Github credentials/keys weren't leaked
Developer keys are required to sign builds. Also Play Store keys can leak just as well.
n3t_admin and so much more
Please humor us
The most secure way to obtain Play apps is from the Play Store. Aurora is considered less secure (and might I add less stable) albeit more private in an obscurity way. Whether Obtainium is more or less secure compared to Play Store is up for technical debate, but your claim of it being highly insecure is not true in my opinion.
n3t_admin fair enough, what makes Aurora insecure then
Compared to Play Store, 3rd party account setup, not up to date android frameworks/permissions, trusting another party beyond Google, are the most commonly brought up issues more of which were discussed in other threads before.