Who controls quality and security in the AUR world? It doesn't seem like something I'd want to trust?

Nobody, but the specs are so simple you can audit them yourself usually. For me it's mostly about low friction packaging my own software tbh.

the AUR is user supported, no claims are made, but AURs are built off of short scripts called PKGBUILDs so it's easy to audit, you're gonna want to look for the line that links to a tar archive or git repository.