To build upon
@skoodlyboop comment, Arch and its downstream distros are as safe as any other distro. Their repositories go through a rigorious review and are no less risky then any other distro.
What the problem is, is the Arch User Repository, or AUR, and there's a clear warning for people to use AUR
View attachment 2650229
The files in that repo are source files that are compiled and so its expected that as you the user should review the make files, before building. So far the malware being introduced is easily identified, as its executing a post install script.
That's not to say you should just install AUR packages, I avoid them because they don't go through a review process. If only use pacman to install/update apps, you're safe. Using yay or paru is where you need to be careful.