> the era of being able to naively and gratefully trust in the armies of volunteer maintainers is over

The maintainers you're supposed to trust are Arch Linux's actual staff made up of package maintainers, formerly known as trusted users.

AUR packages are maintained by randoms on the internet. Anyone can sign up and push a package.