F-Droid does not have restrictions based upon sensitive permissions, such as background location, phone & messaging, etc.
The Play Store has seen a lot of shit and has adapted policies to get that blocked.
Any user can inspect the source code of any app in F-Droid, while that's not even an option for proprietary apps in the Play Store. When someone notices an issue and reports it to F-Droid, the maintainers listen and either change or remove the app listing, with these removals being logged in their weekly updates.[2] For Google Play apps with issues that you happen to notice despite most of the apps being closed source, unless they get media coverage, you'd be lucky to get anything other than canned responses from Google when you report them.
F-Droid also has some great apps that depend on sensitive permissions that are forbidden by Google Play, such as the AdAway[3] ad blocker which uses either the Android VPN interface or system hosts file. AdAway enhances user privacy and security by blocking trackers and malware hosts, so Google did not improve Android by removing AdAway from the Play Store.
[1] Anti-Features on F-Droid: https://f-droid.org/docs/Anti-Features/
[2] F-Droid weekly updates: https://f-droid.org/en/news/
[3] AdAway: https://f-droid.org/packages/org.adaway/
You'll find that several apps had to curtail their protection features a lot for their Play Store versions (e.g. NetGuard).
> The Play Store review process doesn't do a thorough job of checking apps for privacy or security issues and doesn't require apps to disclose anything other than their permissions.
This is wrong. Depending on what you use, more scrutiny is applied, eg an Android Auto extension has to be compliant with road safety guidelines as well, in order not to disctract the driver. The process is not 100% thorough, no, but nothing can be. App devs have to disclose quite a lot on the Play Store actually, it's only getting more: URL where to delete account, URL where to delete data, information on how data is used, tracked and shared.
My main point was security: - No restrictions on permissions is definitely libre in a way, but not secure. - Afaik no codebase or runtime checks to make sure it's not malware etc.