Yeah, Python has been a massive vulnerability for a long while. And the AUR has similar issues. This is only getting widespread coverage now. But it's always been a risk.

Well, those are mostly extension libraries, stuff "normally" installed using pip. Arch is kind of unique that they encourage using system aur over pip, npm and other package managers. While it is a big radius, none of the python packages stick out to me, but maybe I just haven't encountered the popular ones.

Arch usually doesn't re-package Python packages that aren't needed for something else, meaning they end up in the AUR. I maintain several there, and when I stop using them I abandon them. I wouldn't be surprised if some of the ones I used to maintain are on the list