Well there is far less malware on Linux tbf so comparison is not completely accurate. But same caution applies, try to vet and understand what you install. That part is also easier with the AUR as it’s transparent in the packagebuild what it does unlike random exes with closed source. It’s also a large community with many eyes on the code so unless it’s a package with few users then it’s gonna get caught pretty quickly.