How is that an unacceptable threat model for a repo of packages that are optional and user-made? One that clearly says, "DISCLAIMER: AUR packages are user produced content. Any use of the provided files is at your own risk." (1)

The AUR, along with Arch's minimalism, is one of my favorite things about it. Instead of cloning the source repo, reading the build instructions, building, and then installing, I download a script, read it to make sure it looks okay (e.g. the source points to what I expect), and then `makepkg -si`.

> The way I see it installing software from the AUR is about as safe as installing software from the pirate bay.

No, if I trust the source - and I often follow the source link to GitHub to check out the project - then it's like one of my distro's packages, except I'm the one saying it's safe for me to install. I'm not claiming it's risk free, but it's been a great boon to me. (2)

1: https://aur.archlinux.org/

2: I used the AUR to compile and install Goldendict-ng, a fork of the dictionary software Goldendict that's being maintained. It accepts my Stardict converted-from-Apple dictionaries and supports Wayland!