>Breaking into a data center requires coordination and ensuring a lot of people with access and visibility stay quiet

Or just a warrant and a phone call to set up remote access? In the UK under RIPA you might not even need a warrant. In USA you can probably bribe someone to get a National Security Letter issued.

Depending on the sympathies of the hosting company's management you might be able to get access with promises.

I dare say F-Droid trust their friends/colleagues more than they trust randos at a hosting company.

As an F-Droid user, I think I might too? It's a tough call.