Deej-Ai is pretty cool. It uses a model based on scraped Spotify data and can automatically generate playlists. https://deej-ai.online

Plus how would you want to exploit a F-Droid SQL injection vulnerability in the search bar?

AFAIK you cannot trigger searches using URLs, so the user would have to type/paste the SQL into the search field themselves to mess up their database.

Nah, a private instance works fine. Public instances see a lot more traffic and if they use their public IP address for accesing YouTube it is trivial for YT to ban them. If you want to host a public instance, you should use a proxy or VPN for all the YT traffic so yo can easily change the IP address.