I remember when I was using Arch around 5 years ago and I was looking for the Brave browser package, when I found it could be only be installed through the AUR, for some reason I had the assumption that since it's hosted on Arch's official servers it must be properly reviewed even if it was built by the community (like how Chrome web extensions are, for example). And I installed so many AUR packages for things that I used to manually install or find a workaround to install their .deb file on my Arch (using dpkg[0] for example). Then, I was in IRC and I found two fellows talking about "trusting" the AUR, and you can imagine the rest. I started an AUR-detox.

Before moving totally from Arch I kept some AUR packages that I could not let go of, but on the condition of checking their scripts thoroughly and making sure to check them even more thoroughly with each update, and only updating them when it's really necessary. I'm not sure if other Linux package repositories (like Nix) have these supply-chain-attack possibilities or if they employ a better review mechanism, but I really hope if Arch maintainers can find a solution to make the AUR safer, at least more than how it currently sounds.

[0]: https://tracker.debian.org/pkg/dpkg