While none of that applies to F-Droids primary use case (the primary F-Droid repo builds all apps from source itself), it nonetheless looks like they failed to correctly handle the issue.
The only reason this didn't turn into a disaster was pure luck.
The only reason this didn't turn into a disaster was pure luck.