I am using it definetly because of convenience. Not all apps on F-Droid (izzyondroid), Play Store. For me it is unnecessary middleman. But everyone has their own way of publishing apks. So yeah, it is really convenient to have all app updates in one place. Also you can add apps from F-Droid and update them regularly from this app. Incredible work!

This is a good question and a valid concern. However, I wonder if the app really makes in worse then it’s already is. GitHub has no way to share checksums with the builds. The only way to do that is to upload a checksum file alongside the binary. But if an attacker is able to upload/replace a malicious binary, they would be able to replace its checksum file as well. So you wouldn’t be able to recognize this anyway, even when downloading it GitHub, would you?