If it's in the Arch or CachyOS repos, it should be perfectly fine. The Arch packages are maintained by trusted devs, and unless the CachyOS team has been backdooring all their optimized builds this entire time with nobody noticing, they seem to be trustworthy, too.
Generally, if you can get it via pacman, you shouldn't have to worry.
That said, it sounds like you would want password autofill and easy adding. For that, don't bother with the desktop app and just use the extension in your browser of choice. There's no autofill via the desktop app.