FLOSS may have security vulnerabilities, just like any other software. An OSS android app which has no anti-feature flags on f-droid with intrusive advertisements or malware behavior, deliberately implemented by its own developer, is something I have never heard about.

The same can't be said about 'free' (or sometimes even paid) proprietary apps from play store.