This is very likely the case. Arch maintainers do get early information on CVEs just like any other major distro. But with pacman/makepkg 6.1 (which recently r

This is very likely the case. Arch maintainers do get early information on CVEs just like any other major distro. But with pacman/makepkg 6.1 (which recently released) git sources can also now be check summed IIRC which is a funny coincidence.