I downloaded an app from F-Droid once, it was Spotify. Later that week I started getting strange spanish songs on my recently played. Checked my logged in sessions and there were several from latam. I deleted the app.
The real one can be found at: https://f-droid.org
You can also download individual apps (APK files) from the website, so you don't need the store if you don't want updates. Also note how Spotify is not listed if you use their search, because (like others already said) it's not open source and thus not on F-Droid.
(Not a Spotify user, low-volume F-Droid user)
Not totally: the big question remains of how a tampered-with package can reach a prominent repository.