I am rather thinking that, let us say "App XYZ" is super secure and PrivacyTools lists them without affiliation.

Later after sometime if App XYZ offers affiliate, why would they pay PrivacyTools since the app is listed free anyway?

If anything - PrivacyTools should expect donations, not affiliated or marketing revenue.

And I honestly think - they can also go in the direction of having a minimal monthly subscription fee.