So far the answer is:

Some checks to vet the risk:
 * Has been updated in last few months (maintained)
 * Developer has resources to debug
 * Big Organisation where reputation loss is an issue

If no to any of these, then don't use the app.

 * Reviews do not mention security issues

 * App asks for odd permissions that shouldn't be needed

If Yes to any of these, then don't use the app

Project/developer has reviewers/Large, popular open source app across multiple platforms
 * This may be ok but I'm unsure if that works, as it depends if the code is reviewed by sufficient 'Good' Actors I assume?

Related:
https://security.stackexchange.com/questions/267342/what-security-reviews-are-done-on-apps-in-mobile-app-stores/267343#267343
This question is listed as out of scope but perhaps research blogs if you want more information.  Currently no change to the advice above