This is not correct, the only thing you can say against it is that the main repo builds from source & uses its own signing key instead of just hosting an apk and using the dev's key. This means you have to trust F-Droid more than usual, but given their hard stance for all apps being FOSS and notating non free services, I trust them more than Google who has hosted straight up malware, or certainly more than downloading from a random Github with Obtanium with no automatic signing confirmation. It also gives somewhat of a guarantee that what is in the code is actually the only thing in the app. Also if the signing is an issue for you, there is always IzzyOnDroid or dev specific repositories that will still let you manage app updates through F-Droid or third party clients like Droid-ify.