AUR is at least the honest version of the problem: it tells you outright the packages are unvetted, and the ecosystem treats it like a package manager anyway. the cooldown debate keeps optimizing the speed of trust while the missing piece is anyone being paid to do the trusting
