Awesome app. It is somehow not listed on android-foss list so maybe someone didn’t know about it.
Obtainium allows you to install and update Open-Source Apps directly from their releases pages, and receive notifications when new releases are made available.
GitHub page: Link.
If you think about it, any developer could have their account hacked and the attacker upload an APK that includes malware. Obtainium isn’t doing any malware scan or building from source or anything. If you are planning to just install from GitHub anyway, Obtainium should be a no-brainer. But I can see where might argue that having a middleman like F-Droid to validate APK integrity has some merits.
https://f-droid.org/docs/Security_Model/
https://f-droid.org/docs/Reproducible_Builds/
https://apt.izzysoft.de/fdroid/index/info#security