Packaging, yeah, some stuff is only AUR, but that's generally a better starting point than "well here is the source". In general, 99% of what I use is available in proper packages. Obviously that'll depend on what you use.
Definitely not when it comes to security. We are talking about packages, which means even legit, well-intended programs can be weaponized by the packager.
That's a hell of an attack vector.
In contrast with AUR without which you don't have much of a useful desktop experience.
Next thing would be for Arch to officially support SELinux and we're good to go :D
There are notable exceptions where the package license doesn't allow that. E.g. chrome (not chromium) spotify and dropbox.
Most AUR packages I have seen have been incredibly easy to read - if you really don't want to use them, it's still a good framework for making your own packages much more easily, so you can install from source without dumping unmanaged stuff into your system.
> Most AUR packages I have seen have been incredibly easy to read
It's not about quality, but rather more about quantity. I don't have the time to vet every package.
makepkg pulls source files and possibly patches, and then compiles them and installs them according to the instructions. It makes life simple.