#2 can be solved by using one of several alternative clients with root permissions. Yes, manual APK install is tedious but not inherently insecure, and the only option for nonroot devices without an ADB host.
#4 is not really true. They are just very lenient, mostly just flagging apps with problems (known vulnerabilities, telemetry, non-FOSS services/assets/libs, ads).
#5, #6 and #7 are actually advantages. It’s nice to know that all apps are FOSS and correspond to source, and I can install old apps / earlier versions on old phones – as opposed to Google Play, which denies an app’s existence if your device is incompatible, resulting in shady alternatives and adware typosquatters topping search results.