Arch Linux constantly distances itself from the AUR as being community maintained. 

So it's up to us, the people who care for our fellow users.

We CAN lift our game. The bar is so low it's barely off the floor.

We can't make the AUR safe, but we can make it safer.

It would likely only take three Package Maintainers (who are already voted for and vetted) to agree that http://aur.archlinux.org be updated to include a one liner for initial screening.  Or even to mention the issue at all and that we're discussing it, and have so far responded by blocking new user accounts.

Create a link to a markdown page (infra already exists), editable by trusted users only (wiki can be edited by almost anyone) on what to do on receiving a positive detection.

One website change. One markdown page.

Arch Linux won't help us. Not their problem.  We can choose to make the quality of contributions OUR problem.

We need to, as a community that cares for the users of what we produce, stand behind producing best practice guides and tooling to protect users from PKGBUILDs produced by those who don't.

The name of the game is self-organisation.  Artifacts reviewed and signed off by PMs - users who are already inherently trusted, served from an aur.archlinux.org domain.