Absolutely, I agree with you. However F-Droid is a tricky one. They build AND host packages themselves, and they had security issues. Way too much trust placed in them. The only way that makes sense to use F-Droid is with reproduceable builds.