People are warned countless times that the AUR is unsafe, that any random person can make an account and push packages, that you need to audit what you're downloading and that malware has been discovered in it multiple times in the past.