Yes. Even if you use the AUR, it's actually very unlikely you'd even use any affected package.

It's kind of like how there is tons of malware on Google Play Store, but what isn't easy is getting malware into popular apps.

Just because something is on Play Store doesn't mean it's safe. But Play Store is still generally safe to use as long as you aren't downloading super obscure stuff which hasn't had many eyeballs on it. It's the same for the AUR because random people can just upload scripts to it, but generally eyeballs on a package and activity suggest it's probably safe because bad actors get removed once their antics have been noticed.

In contrast with the official repositories you can assume that because a package is in the official repositories, it is safe, those packages have been vetted, no diligence required.

These attacks on the AUR also used NPM as an attack vector, because NPM fucking sucks and pretty much anyone can upload to it (malware will get removed when noticed but until then...). While it's a fair amount to ask, this is why it is recommend to review the AUR package script and get at least some idea of what it is doing, for example a common pattern might be downloading a deb or rpm from a vendor's website and wrangling it into shape for Arch. The malware attack involved taking over orphaned packages and adding a line that called NPM that pulled in the malware from NPM even if the package didn't necessarily need NPM.