"Aaagh! There's malware in the AUR! Abandon ship!"
Me, an inveterate Arch user: *shrug* *sips tea*
You do understand that the AUR is not official and you never need to use it on Arch, right? My Arch install is happily AURless, and has been for years.
@pfxel Thanks for the excellent question! I only use a couple things from outside sources. For one, I simply download the archive directly from the packager's website and install with pacman -U; I trust the provider, as far as it matters, and the package doesn't update often. For the other, I found it in the Debian repos, so I installed it via Distrobox. With an alias to launch it from the command line, you'd never know it was in Distrobox, and it's not something I use often or need to update ever, really.
Of course, everyone's use case is different. I've just never felt comfortable with the AUR, so for me it's been worth finding alternatives.
NegativePrimes
pfxel