The explicit expectation with the AUR has always been that you can't blindly trust the PKGBUILD files. It's more like running an installer from a random website on Windows than it is to using official distro repositories. I think the wiki also always advised against using AUR helper tools that blur the lines between official repositories and the AUR.