I don't disagree with your overall point, I don't think, but having reproducible builds doesn't -- alone -- make a distribution method more secure. I can publish an app with a bunch of security holes and maybe even some obfuscated malicious behavior, but if the F-Droid maintainers don't notice, it doesn't matter one bit that a user could reproduce the build they made.

Of course, I don't know if we can say that Apple's app store approval process filters out more or fewer security issues or malicious apps than F-Droid's vetting process does.