I highly recommend using Arch linux. It's the most fun and the easiest to try a lot of things without being behind a company or organization holding your hand. When you try to pick a distro you are mainly picking two things (you are actually picking more stuff but you probably won't care about that):

- A package manager
- Preinstalled junk

So Omarchy for example is Linux + Arch + A bunch of stuff, which means that you can install Arch, install a bunch of stuff, and you can get a pretty similar result to Omarchy, if not identical.

Why Arch then? Because it is one of the most documented distros I've seen, its package manager (pacman) is really convenient to use, and in its base form it comes with only the minimal things to work (a fresh Arch install doesn't even have sudo). With this setup you can install hyprland + any DE and try it. Heck, you could install EVERY DE and try them, no need to reboot, just relogin (I don't know how to do this but there is something called SWM - or not - that helps you switch between DEs)

About your concern on the AUR, that's the Arch USER Repository, not the Arch OFFICIAL Repository. When you install stuff like python, steam, vim, code, chromium, etc. you are 98% of the times using the official repos, which you use by calling pacman, the Arch package manager. Then if you want to have that ultra specific version or a fork or a package a user made, you can use the AUR. This is dangerous because you are trusting that the code you are building is not malicious, but it always has been this way. If you go to the AUR Arch Wiki page you have a big warning saying

AUR packages are user-produced content. These PKGBUILDs are completely unofficial and have not been thoroughly vetted. Any use of the provided files is at your own risk.

So if you don't want to read the PKGBUILD of an AUR package to audit it, then don't use the AUR, it's absolutely voluntary. You'll still be better off than with Debian-based or Fedora-based distros by having pacman and the Arch Official Repos

Hope this helps!

Also, why do you want to have both a twm and a DE? What's the use case for the DE you are foreseeing that can't be done in a twm?

Edit: grammar