This works very well for tech enthusiasts and people who self-host nextcloud at home.
The issue is when you are a government or university, it becomes harder to get all your users (which are probably not all tech savvy) to install a third party app store deal with the Android warnings about installing from third-parties, etc etc.
And this is probably the user base Google are targeting with this move (assuming it's malicious) . When the higher ups complain that their files are not syncing and need to install things with a special procedure they sometimes wonder why they are not using M365 or Google which seems hassle free.
Not to mention the "see this big alert saying this isn't safe? Well for this one time it /is/ safe so do so" While curbing the mentality of "oh it was safe last time so it must be safe this time"
It's not as simple as telling people to use F-Droid. People with non-rooted phones won't get automatic updates via F-Droid which is a big hurdle. Unless I'm misremembering? I wouldn't know because I run rooted CalyxOS now. Last time I used F-Droid on a plain Android phone is a while ago for me.
In the Basic version only, last time I checked the "original" F-Droid couldn't do it. And there's also some minimum API level an app has to target to be eligible for automatic updates (found that out through updating microg and having to click "update" still)
My phone is not getting CalyxOS updates anymore. Gotta wipe it all and move to lineageos now. Man I hate mobile operating systems. I need good linux phones right now. Android can go to hell.
People with non-rooted phones won’t get automatic updates via F-Droid which is a big hurdle.
Not true if the app to update targets a high enough API version (I think API 34 or 35) and if you use F-Droid Basic.
NOTE: The Basic version of F-Droid Client has a reduced feature set (e.g. no nearby share and no panic feature). It targets Android 13 and can do unattended updates without privileged extension or root.
For fdroid the app is compiled on fdroid servers when dev tags a new release on GitHub. So the app matches the source, it's not possible to put a tainted APK to download
Now, if the malicious code is slowly added to the source over the course of an year like it happened with the xz utils, this won't change the result, but it's easier to do so with a compiled binary. Release clean source and infected binary, it will take a longer time to get caught
For the closed source app stores, on iOS there's the manual inspection (which is not infallible especially if they timebomb or geofence the bad feature) and for Google there's the automated inspection (which fails often seeing the news) that should find problems
They have problems with the build process and verification, also the software is sometimes out of date on fdroid. In addition I dont personally want someone else curating my software library.
More like F-Droid cares about things like reproducible builds and other best practices, and sloppy upstream projects sometimes have a problem coping. But as I understand it that's typically the upstream developers' problem, not F-Droid's.