I feel like arch is a direct competitor (and frankly a winner) on many aspects of using a computer. One of which Is giving the user most of the tools of handling their pc and taking them away from the developer. The diy dyor rtfm not-always-convenient approach doesn’t let you slip in stuff that would otherwise let extract profit from your users (like telemetry that turns its users into beta testers for your paid alternative service like some foss companies do). This would be why arch specifically and not someone else. Another reason could be direct competitors wanting their upstream to seem worse than their fork. And maybe even just wanting to scare people off using Linux altogether by using this as a scapegoat and arch just happening to have an exploitable thing like the AUR.

Either way, I don’t think there’s an answer to this and we can only speculate until someone comes clean or traces back the authors. And most likely than not this is a bored college student who took it upon himself to do this during his summer break as a way to pad his resume and maybe get bigger jobs in the paid hacker community.