Their download page doesn't make this clear: Molly is not on F-Droid.
Instead, the Molly project hosts an F-Droid-compatible repository, which you can configure your F-Droid client to use in addition to / instead of the F-Droid repository. If you do this, the downloaded software will come directly from the Molly developers, not from F-Droid.
Some people avoid this because it loses a layer of oversight. Others prefer it because it avoids a potential attack vector. You'll have to decide for yourself whether it's something you want to do.
It's worth noting the reason why Molly isn't available on F-Droid proper: it's entirely F-Droid's decision. F-Droid policy requires that developers support (or do not oppose) inclusion in F-Droid, which Signal's developers haven't. Signal's developers are also hostile towards forks and do not want them interoperating with Signal. Thus, F-Droid does not allow Signal or any fork of Signal.
I am not really a fan of this decision, I don't think it's logical that an upstream can forbid a fork from being published anywhere - but that's F-Droid's call to make.