If I'm mistaken, I thought F-Droid verifies that the code is not malicious before they release it. That's why it takes a couple days to release on F-Droid. For me, I don't really worry about malicious...
No, they don't. The rebuild is only for the sake of rebuild.