Especially since F-Droid packages are mostly built from source on F-Droid infrastructure, and all source tarballs are kept forever. That way, even if something slips through, it can be tracked down.

https://f-droid.org/en/docs/FAQ_-_General/#whats-the-differe...