Yes, of course, the 40 lines still exist for the core repos, but the maintainers are presumably trusted. I agree with the rest, I'm really talking more about t

Yes, of course, the 40 lines still exist for the core repos, but the maintainers are presumably trusted. I agree with the rest, I'm really talking more about the comparative risk from AUR compared to the repos. The real danger is that someone snuck something malicious in the PKGBUILD and that no one noticed yet. Other than that, the threat is the same as using the repos, assuming you trust the maintainers, which is IMO a reasonable assumption if you're already using it as your distro.