I was thinking that too, like downloading random .exes and complaining your Windows got a virus. At least now a days, Windows .exes have a signing process that warn you, but that's just like using non-AUR sources; they're verified.

But we like Linux because it doesn't give you a big scary full screen warning every time you try to open something... so IDK. If that's what you need to keep you from installing malware, get off Arch.