Not sure if sarcasm or actual disinformation. You’re not supposed to trust the aur, that’s kinda the whole point of it. The build scripts are transparent enough to allow users to manage their own risk, and at no point does building a package require root access.