Unfortunately it was a no-go for me for the following reasons, but the situation may have been improved since then:
1) Back then it was only recently that they had instituted package signing and verification for their official packages. Ouch! That was something that most distros had for years back then. So security wasn't their primary concern.
2)There were 2 or 3 package managers. pacman was the one, don't remember the others and I didn't understand their purpose.
3)They were touting abundance of packages, but these were mostly AUR packages. AUR packages, back then at least, were completely unvetted, arbitrary packages provided by... anyone basically. And the official Arch documentation was crystal clear that they don't support them and that the user, individually, should inspect each one for their integrity or possible malicious intentions. Uh, no thanks.
Hope the situation has improved because I was planning to give it one more try at some point.