Many AUR packages just pull from the HEAD of some git repo or pull down X random tarball from a URL. With something like Debian, you have layers of package mai

Many AUR packages just pull from the HEAD of some git repo or pull down X random tarball from a URL. With something like Debian, you have layers of package maintainers in the middle to insulate against attacks, and specific, immutable bundles of data included in the packages themselves. Also, the entire Debian infrastructure (signing keys and all) being compromised, and such an incident going unnoticed, is a much less likely occurrence than the same for the hosting site some individual software author uses. Sure, you can still add third-party repositories to Debian and install deb packages from outside the main sources. But when you do that, you're making a conscious decision to do so, on a package-by-package basis. Any package you pull from AUR could be vulnerable, unless you manually check the source of each and every one. When you install from the Debian repos, you can trust that a certain standard of quality and security is being upheld.