Somehow I really doubt telling an average user to assessing pkgbuild on their own

Arch Linux is not really made for the average user, and using code from AUR even less so. I doubt it that everyone using Arch+AUR or CachyOS or youname it is served well by this.

And making it kind of accepted norm to run untrusted code as a non-technical user will bite the Arch community in the ass. For Arch, it is a phony measure of success to have many such users.

This is also a result of Windows user attitudes leaking into the Linux universe. You need to discern code and data, and you can't run untrusted code, period.