I think people can hide lots of things in code, especially when people don’t generally look at it. And I know people don’t look at it when they talk about how convenient the aur is. It’s at best marginally more convenient than installing from source.
I’m not at all suggesting that people should place more trust in large companies. I’m suggesting that packages in the aur with lots and lots of users should be trusted more, specifically because some of them will be checking out the pkgbuild, and the source, and presumably some of them would notice if the software did something it wasn’t supposed to do. Obviously the larger the software the harder that all is to check, and correspondingly you’d want to see many more users using it before you’d extend it any trust.
My point being, i’ve not seen these discussions taking place. Maybe I’ve just missed them. But I feel like it’s appropriate to bring it up when I see people talking about just how.convenient the aur is. It’s really not that convenient if you’re using it in a way that i’d consider reasonable.