F-Droid only carries FOSS. Technically, that wouldn't prohibit a malware vendor from getting their app into the catalog, but like the processes for package repositories for desktop distros, there's a lot of cultural, social, and procedural baggage associated with being the kind of project that gets distributed through those channels. Who's going to go through the effort? The whole point of shovelware is that it's a low-effort process.