Yes and no, your average end user trust the Play Store and the promised security which is why an app once it’s inside can get millions of downloads.

Compare this to trying to get your average user to
a) trust your selfhosted app and
b) succeed in installing it.

Also, I can’t find a single malware that has used f-droid as it’s primary vector.