yeah. in the “obtainium is more trustworthy because it distributes trust” vs “f-droid is more trust worthy because it reduces attack vectors” i tend to fall in the latter camp. sure, if f-droid is pwned, nearly your entire phone is pwned, but with obtainium you’re more at risk for death by a thousand papercuts.

i’m not expert enough to speak authoritatively between the two stances, but i know enough people who are split between the two to say there’s compelling arguments on both sides, i just picked what matched my understanding of my vulnerabilities best