That's not just theoretical, if you google it they have tampered with build signatures of joinmarket in the past.
Discussion
And its owned by Microsoft. Im not so sure Obtainium is the best option pulling from github. F-Droid isnt perfect either. Just trying to figure out the safest most free way to get my apks from. You have been very helpful widening my understanding!🙏