warn on apps that allow cleartext traffic
Apps targeting sdk>=28 have to explicitly opt in to allow cleartext traffic: https://developer.android.com/training/articles/security-config
F-Droid can show a warning (and possibly an error at a later date) when it detects such an app.