The trick is figuring out what parties do that without constantly sniffing traffic or reading source code. Sometimes I wonder what all on F Droid has malware.

Examples:

• Microtransactions instead of asking for the price up-front
• Using gambling mechanics in non-gambling games (e.g. loot boxes)
• Eliminating potential stopping points in the user interaction, like e.g. endless scrolling instead of pagination
• Using big, visually engaging buttons for the actions they want the user to perform ("Accept tracking") while using tiny, grey links for the actions they don't want the user to perform ("Reject tracking"), or even worse, hiding the action they don't want the user to perform behind multiple menues.
• Using wording that creates fear or other negative emotions to stop users from performing such actions ("If you cancel your subscription now, you will lose access to this, this, and that. Everything you did will be lost. Do you really want to do that?")
• Disguising ads and other non-organic content as organic content. ("I found this product and it cured my hair loss, my potency issues and made me rich at the same time! sponsored ad")
• Disguising ads as notifications
• Disguising ads as the download button
• Agreeing to do one simple action contains a hidden agreement to a ton of other things

And many more things like that.