I use arch (kinda), and has zero issues. It was a problem if you used unmaintained packages from arch, as adopting them and contaminating then was the attack vector. Using someone that's unmaintained is always kinda questionable, so instead I'd just manually install that instead (it shouldn't change if it isn't maintained anyway).