F-Droid is an odd one. The apps aren't malware but in my experience most of the apps on it are pretty low quality in at least one area (especially in user interface and experience), but that's a problem prevalent in FOSS in general, not just F-Droid.

I'd say the Google Play store is the one actually full of awful software a lot of which is actually malware. Part of this can be attributed to Google's loose requirements and the other perhaps Android's security model in general is too permissive. It's very easy to fuck up your Android phone in a way that you simply can't on iOS.

I'm not terribly concerned about it since I think a lot of it comes down to how iOS and Android are designed, but it's not not a concern.