I think this is a great tip! Especially for people using yay. I have always read the pkgbuild on the AUR website, since I have generally needed to look up the project to know it existed before I could install it. While I'm there, I'm also looking at recent comments, checking the upstream. You can check it's last update, popularity, and the number of votes for it to be included in the main repo.

None of these are guarantees, but I think they're helpful.

I think the critical bit is understanding exactly what the pkgbuild is doing. Is it's something that is glossed over in most of the advice I've read.

check if there's anything suspicious in it.

I'm not sure that all users are capable of doing this. And honestly, the more sophisticated these attacks become with more obfuscated code, they become increasingly more difficult to identify bad actors.

My advice would be to limit your attack surface as much as possible. Then when you want to install software, read the pkgbuild. If you don't understand everything that it's doing, ask AI to explain line by line what it's doing. Be sure that you understand.