FYI, CachyOS is Arch based. It has access to the AUR. If you weren't effected, that proves the point.

The AUR is a repository of last resort. It's useful, but you should be careful. That's true even before this even. It's a repository made by users, and is not verified.