Linux

Yeah and in reality people are lazy and go for the easiest route (not a criticism; it's just human nature). The AUR is popular because it's easy to download from; the problem is that it was based on the assumption that "someone" is keeping it secure. As it was so popular people assumed that it must be secure because everyone else is using it, and particularly with reassuring voices on tech forums who make a it a badge of honour to use the AUR with Arch. So the AUR has been normalised for lots of users.

It's a bit like how Wikipedia is trusted by lots of people but in reality there are huge issues with bias and factual errors. People seem to forget/?ignore the warnings that Wikipedia should never be treated as a primary source - because it's quick and convenient to just look at what's on Wikipedia and believe it.

I saw someone saying they use Arch because Arch + AUR is the closest you can get to a Windows-like experience on Linux; the AUR provides a huge range of software. The problem is that the Windows-like experience is the ultimate open trust based network. You can download software from anyone anywhere and launch it on your computer. Windows is also a hotbed of malware and viruses as a result, even with the restrictions that Microsoft has put on users over the years.

Securing the AUR is nigh on impossible I think; it's hard enough for distros and OSS projects to find enough people to maintain close trust-based systems in popular projects let alone the people needed to do the code audits and package checks for 100k+ user submitted packages. Maybe they can change their model a bit though - have a curated section of popular packages that do undergo some kind of audit and "certification". I think it'll survive this as it's a popular resource for all it's issues, but trust has rightly been dented. And in fairness that was a false trust as the AUR has never pretended to be anything other than what it is: people have chosen to accept the warnings that they use it at their own risk.