The AUR is definitely a bit of a security risk. The best is to not use it at all, but if you have to use the AUR, then either make sure that the package doesn't have malicious code inserted into it or only use popular AUR packages that likely had someone else vet them already.