Could it be because a niche is not such an interesting attack vector?

Maybe a little, but more importantly, all apps on F-Droid are open source, and verifibly built from said source. It's very hard to hide malicious activity on it, whereas duping the Play Store content moderators is like taking candy from a baby.

For a small apps there's nothing checking against intentional malicious activity. Sure it'd be there in plain sight, but it's pretty unlikely really that anyone would read the source code of some random single person project.

Google doesn't know whether you're installing F-Droid or Totally-Free-Money.apk.