I'm very tired of the rhetoric that Arch is only meant for tinkerers. If all you do is have plasma steam and a web browser it's no more or less likely to break than any other distro. You could go your entire life without ever looking at the terminal.

And while yes this malware is a problem it is specifically in the aur, the arch user repository an unofficial repository not officially supported, just don't use it. Unless you need a weird piece of software generally related to some type of specific hobby you're unlikely to ever even want to look at it anyway.

I suppose so. I run Cachy now but that's only after 3 years of switching distros several times and getting more confident with how Linux works.