This is not correct, the only thing you can say against it is that the main repo builds from source & uses its own signing key instead of just hosting an apk and using the dev's key. This means you have to trust F-Droid more than usual, but given their hard stance for all apps being FOSS and notating non free services, I trust them more than Google who has hosted straight up malware, or certainly more than downloading from a random Github with Obtanium with no automatic signing confirmation. It also gives somewhat of a guarantee that what is in the code is actually the only thing in the app. Also if the signing is an issue for you, there is always IzzyOnDroid or dev specific repositories that will still let you manage app updates through F-Droid or third party clients like Droid-ify.

Why?

Not according to graphene documentation. From what I remember it's because Obtaniuam can't check the signature of the APK. There is app verifier (recommended by obtanium) but it dosnt work with many apps as they don't publish the signature. So you can't verify the APK is what its supposed to be.

FDroid builds the app and signs it. While this may intorduce risk of Fdrpid are doing something dodgey the many eyes and build logs should pick it up.