Their download page doesn't make this clear: Molly is not on F-Droid.
Instead, the Molly project hosts an F-Droid-compatible repository, which you can configure your F-Droid client to use in addition to / instead of the F-Droid repository. If you do this, the downloaded software will come directly from the Molly developers, not from F-Droid.
Some people avoid this because it loses a layer of oversight. Others prefer it because it avoids a potential attack vector. You'll have to decide for yourself whether it's something you want to do.