Aur is probably the main reason why many people use Arch and derivatives.

FYI, non-Arch distros can use AUR with an Arch distrobox. So people shouldn’t be using Arch just for AUR.

Being in a distrobox may or may not protect your system from potential malware, that I cannot say.