Arch Linux has a policy of not deviating from upstream unless necessary. Their maintainers are unlikely to decide on compiler flags that specifically go against the KeePassXC developers wishes.

Usually there's a binary package Compiled to whatever "upstream" considers stable. And then there are lots of AUR Packages, some binary, some src with variations.

You usually don't. But if maintainer made such a controversial move it is very easy to fork-off the package and share with others. I'd expect a "real-keepassxc-not-some-braindead-nerfed-one" appears on AUR before I hit the problem.