Fdroid one is built by the fdroid team the other is built by github actions (on github servers, using the original dev's instructions).

The fdroid team curates packages: they validate signatures, checksums, build reproducibility, checks for suspicious app behavior, etc. The disvantage is that the fdroid version always lags a bit behind.

In terms of attack surface: the fdroid build can be tampered only by fdroid while the github build can be tampered only by github before arriving at your phone.