[Wonderfall]

Funny you should mention NewPipe since they discourage users from relying on the official F-Droid repo for the very reason of slow updates, which you don't want for an app relying on parsing web pages that are likely to change. The app itself (at least the regular build provided by the developers) sends you a notification once a new update is available. They also maintain a third-party repository, which again is fine at mitigating some issues of the official repository (while breaking the security model because the OS inherently wants one source per app repository, but at least it's more usable than waiting for the F-Droid build to be updated).

F-Droid can't do anything against "secret code" since they don't/can't analyze the whole codebase. Like said multiple times, they only run a few scripts on the available source code to remove known trackers, which is known to be a poor approach to privacy.

[selfhoster11]

I actually use direct APK downloads for myself, and F-Droid for my mother, who is far less technical and therefore benefits from the easier end-to-end UX for the update process. Even with delayed updates, having NewPipe unavailable for two or three days is preferable to using the official YouTube app in the Play Store, which doesn't have the features she relies on at all, or a direct APK download that may expose her to the risk of malware.

That said, I should really set her up with a third party repository for updates.