> That creates the expectation, rightly or not, that the Arch User Repository provides some degree of protections for Arch Users against the build sources hosted there being compromised.

The main page of the AUR website says, in bold, "DISCLAIMER: AUR packages are user produced content. Any use of the provided files is at your own risk."