Hacker News Reader

Not really. No one targets F-Droid. If they did, there would be malware. F-Droid barely audits packages at all.

Not really. Debian repositories also contain zero malware, and I don't think they audit evert package and every update.