Their complaint about chaotic is the exact same that is mentioned 4 paragraphs before as coming from AUR in general, and they also mention the same thing can happen with other distros / package managers… It all loops back around to not blindly trusting everything in the repos. Which loops around to not blindly trusting anything on the internet in general.
Also I’m pretty sure you can use Garuda and avoid chaotic and use standard AUR instead, if you for some reason trust AUR fully but don’t trust chaotic at all. I’d have to double check that about system level packages, but it’s definitely possible with anything you seek out to install after the initial install of the OS.