Android need an AV, not only because the apps, when yo use also the mobile to surf internet, which is a risk for every OS without protection, especially now with the war, which is also waged online and where all kinds of malware have increased dramatically. Well, GPS, it’s a difference if a webpage or app knows your country with your públic IP, or it knows your exact localisation because your GPS when it isn’t needed to work. I know that F-Droid isn’t the Panacea, but it is way better and more secure than Play Store, also GitHub has it’s flaws, first it isn`t a FOSS repository and second it’s proprietary of M$. Apart the F-Droid app can update the apps, in these from Github you must controll and do it yourself. Anyway, as I said in the first point, a smartphone never will be a safe dispositive and never is advisable to have sensitive data in it, its irrelevant if it is Android, iOS or Linux. see the cases of the supposedly safe smartphones of presidents and politicians hacked and infected with spyware not so long ago and worldwide.