Fdroid is also extremely insecure:
Discussion
I mainly use Obtainium and Github release urls. Some apps are unforunately only available via Fdroid.
You can install fdroid apps with Obtainium. It even works for 3rd party repos.
also if you hack a bit with regex you can turn every http page in a repo. I update whatsapp and electrum from obtanioum and versioning is handled like a charm