The PKGBUILD of packages in the official repository can be changed, which people theoretically could use to inject malware. That's what I meant.