It's amazing that people criticize Windows security with .exe's and then install packages from external repositories with the security of "trust in the repository".

As with almost every case of these sorts of comparisons, these are likely separate groups of people holding separate groups of opinions.

I don't use Arch anymore, but when I did I found that the AUR was really useful to quickly install niche applications that would take ages to be approved on to an official repository. Often those would be made by the application developers themselves or members of the community. I would personally vet the packaging script myself, but I'm sure many wouldn't - and that's fine. As with most software, there's some trust involved and often you assume that if you're installing from a reputable repository it's going to be fine. If people aren't vetting the installation scripts and are installing from random repositories, that's really their problem. I'm glad the possibility existed and it's the one thing I've missed in distros I've used since then.