If we are talking about bigger projects with hundreds of thousands or millions of downloads, than this may be true. But smal scale projects have so few people actively looking through them that even to automatic scan done by the playstore has a higher chance of catching malware. It doesn't even have to be bad intent, two years ago there was a virus propagating trough the Java class files in minecraft mods which reached the PCs of quite a few devs before it was caught.

I don't dislike FOSS, a lot of the apps I use come straight from github, but all this talk about them beeing constantly monitored by third parties is just wishful thinking.

There is no guarantee that the released app is exactly the same as the source code when getting it on Google Play. You'd have to decompile or compile from source and try to compare.

Using F-Droid is good alternative.

Yes, but we don't know what we don't know. There are many problems like that in open source too, and even if we can look nobody does.

Therefore I find it problematic to say that just because you use open source programs you're safe like the parent tried to.

Yes, that is true, but let's not pretend that just because some one is theoretically able to, that all source code is constantly monitored by 3rd parties.

Very disingenuous of you to fight a strawman and proclaim victory by claiming that I said things which I never did. But if that's what floats your boat. But for everyone else, try to find any mention of anti-libre software in the original claim.

With the new changes to the repo management, that's not going to remain true for much longer.