What part of it? The app itself? There are alternative clients. The protocol? It’s made for people to host app repos, not to ensure everything hosted in an F-Droid compatible repo is safe. The fact that reproducible builds arenct enforced? There’s always a gap where you’re trusting a third party unless you’re building everything from source yourself.

It’s the android equivalent of a package manager.

F-Droid is like any other place you get apps and programs to run on one of your devices: caveat emptor. At least all packages are open source so you can review yourself.

This is as absurd as saying you don’t use linux because someone could typosquat a fake repo or app through the package manager.