In addition, Fdroid vets apps far better than Google ever has so I’m comfortable with the app’s security.

I agree but they aren’t checking every version for malicious changes. they would likely only get to know if a user checks it and notices it, and the developer could just make the change for a single release version.

of course that applies to any app but this handover/takeover was very sketchy.