F-Droid doesn't accept binaries. Your application has to go through their build system. So at the very least, if you run an app you get from F-Droid, you know you can get to and look through, the original source.

Everyone can't audit everything, but if you're trying to write something new based off something existing, that's how people find bad actors and bad stuff.