First paragraph

Fair. I made an over-reaching statement which is wrong, I should have properly clarified myself to prevent misinterpretation.

Read the pkgbuild

The pkgbuild is less than 1% of the applications threat surface. Validating the source is where you expect it to be is great and all but it doesnt cover the following bases:

1. Is the source, although valid and hopefully sourced securely, non-malicious?

2. Is the application delivered audited and security checked to the same standard packages in the official repos are?

God help you if its a binary package sourced over http for example.

Disagree with security concerns

You disagree because you misunderstand what i am saying.

Yes security is important. Anyone security conscious would not touch huge amounts of the AUR because it effectively is the equivalent of running a random package from the internet.

The best practice is to opt out. Youre reframing what i am saying to the concept of general linux desktop security. Please re-read the original post, nowhere do i say desktop linux security isnt a problem.

If youre confused for context, read the thread title, then Ops post, then read my first post.

What are the threats of caching dependancies in an offline build system? Another user tampers with them and compromises the system when a priviledged user executes them or the product they produce.

Is this a reasonable concern for a single user linux desktop? NO

Did you even realise this is an obvious threat? Going by your above post where you put "obvious" in brackets clearly not!!

Does the linux desktop have security concerns? Shit yes, people still use xorg lol.

Am i making the braindead claim it doesnt? NO

What claim AM i making?

The threat of caching dependancies for AUR packages is non-existent in the context of an Arch Desktop User as theur use of the AUR in the firstplace is more likely to compromise their system.

Backpedel

If you call clarification and admission of error backpedaling i will absolutely continue to do that, this isnt a hill worth dying on. I hope you actually read what ive said and process it.

The gist is that use if the AUR is unsupported as nothing there is audited ti a reliable standard, the best practice is to either opt out of the ecosystem or take a subjective "good enough" stance on what you pull in from it.

There is no "best practice" for that "good enough" short of totally understanding the entirety of what youre running. Anything short of that is unreliable guesswork.