Yes, F-Droid has some security issues with PKI/outdated dependencies. But never malware. The first is a technical problem that can be fixed with one or two NL-Net projects, the second is a fundamental misalignment of incentives.