> No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on?

Well, for one almost everyone on Windows. That’s changing with winget and such but the standard Linux method is still an anomaly in desktop computing as a whole.

Those users do look at the domain/URL though, where they are getting it from. The way to do that when using AUR, which they are explicit about, is to review the download source from PKGBUILD, which would be the same as a Windows user looking at the addressbar when they download something.

I know it's hard to believe, but many users, even Windows ones, actually check if they're on the right website/in the right GitHub organization, before downloading binaries.