I just saw a comment in a thread saying to change the mirror when someone using fdroid was having issues because the mirror maybe syncing that got me to think that if the mirrors are hosted by different parties isn't there a chance some of them could be malicious ? Are alk the repos under fdroid with different URLs or something ? I'm not familiar with how they host that and couldn't find something by searching . Is there any precautions in place to make sure all the mirrors serve the same thing and hasn't changed anything ? Is there any problem with only enabling the official mirror other than if it goes down or is under sync/maintainence ? Should i just keep using that one mirtor ? If this really is a security risk why doesn't the fdroid team give any warning at all i think they have been always upfront and honest about these things and all the mirrors are enabled by default too .
Even if the mirrors are all hosted by the same admin team that doesn't mean that they will sync at exactly the same time and that they will serve the exact same content at the exact same second. Mirroring download servers do not use distributed transactions.