I assume you don’t trust Google either, so another advantage of the F-Droid version is that it doesn’t contain the proprietary code blobs from Google.
But I think your right to distrust GitHub. Even if Microsoft doesn’t put malware in it they’ve been known to censor projects on GitHub in the past, it restricts access and blocks accounts based on nationality and geolocation, and especially in the present climate we can expect to see more of this or worse. Codeberg seems to be a more open, trustworthy, and reliable alternative.
Or when the build system of the developers is compromised.