One of the many reasons I refuse to use Debian. You just don't get this kind of BS on Arch Linux, you get to chose what you think is right not what some maintainer decided is correct.
Arch isn't special. On Debian, or any other distribution, if you don't like how a component works you can still compile and install it from source yourself.
The maintainer doesn't decide which compiler flags to enable for the build? Does that mean that you build everything from source in Arch Linux?
You usually don't. But if maintainer made such a controversial move it is very easy to fork-off the package and share with others. I'd expect a "real-keepassxc-not-some-braindead-nerfed-one" appears on AUR before I hit the problem.
Usually there's a binary package Compiled to whatever "upstream" considers stable. And then there are lots of AUR Packages, some binary, some src with variations.
Arch Linux has a policy of not deviating from upstream unless necessary. Their maintainers are unlikely to decide on compiler flags that specifically go against the KeePassXC developers wishes.