Lukas Chiming in since the following really ticked me off:
When you obtain your app directly from the developer you’re 100% trusting the developer to not include anything spooky in the app and the more apps you have the more developers you’re trusting. If you have 20 apps from 20 different developers, then you’re trusting 20 different developers.
You should never use F-Droid or any other repository with that assumption.
You might be thinking that I’m dumb because you still have to trust the developer of the app, right? But the thing is that F-Droid builds their apps from source which is a lot less difficult to inspect then reverse engineering APK files, and it’s a lot more risky to include spookiness in your source code.
I'm sorry to have to say this again: when you're using F-Droid, you are not only trusting F-Droid, but also the developer. F-Droid does not conduct a deep security analysis of every app source code.
It would be extremely difficult, as time has shown security vulnerabilities can be tricky to spot with a mere human review of the source code. Moreover, security vulnerabilities can be cleverly obfuscated, making them even more trickier to notice that way. Many GitHub repos are actually hosting obfuscated malware code: one should not think the source code is safe just because everyone can see it. Source code is quite hard to inspect, and I wouldn't even deem Dalvik bytecode reverse engineering as a lot more difficult.
It is even more difficult when you take into account that every source code update should be reviewed. This is not humanly possible and I doubt F-Droid have the resources for that. Not even Google or Apple do. F-Droid does check for binary blobs and the likes that would violate their inclusion policy. They may check for known security vulnerabilities through automated ways (mostly scripted libraries checks). They also literally run virustotal. Which is not harmful, but far from flawless. However, this approach can become harmful the second you think this is a robust security guarantee.
Things have evolved since the blog post linked above was written. F-Droid does now offer a more reasonable client with less attack surface and an updated target SDK, and honestly you should just use it in lieu of other third-party clients if you're going the F-Droid route. Reproducible builds are now more common, there were only a handful apps in 2022, and they're now close to 200. Most modern apps on F-Droid are also distributed through Play Store, so they benefit from Play Store strict inclusion guidelines as a side effect.
You can use F-Droid, but don't use it for the wrong reasons. Use it because you like what they do and you like having a catalogue of FOSS-only apps if that's your thing. Nothing wrong with that. Personally, I love FOSS apps and I don't use F-Droid, and Obtainium is now good enough to make the process of updating apps from GitHub a lot less painful that it was.