F-droid doesn't simply distribute build apps. It requires the source to be open and will build the apps itself. This does not guarantee there will be no bad actors trying to slip in malicious code. I do believe they also do initial audits before an app is allowed in their repos. It also often takes a while for an app update to show up in F-droid, I am not sure if that is due to auditing updates or something else though.

More here:

- https://f-droid.org/en/docs/Inclusion_Policy/

- https://f-droid.org/en/docs/Security_Model/