Ordinarily I use apt. Sometimes a flatpak if I trust the source. Otherwise it's from source or usually something i'm running in docker, where I'll check what it's actually doing if i'm at all suspicious.

I don't want to make too big a deal of the aur. When I was using arch and I needed something from the aur it was easy enough to see that it was a legitimately packaged piece of software. The only big deal is that it's a real pain in the ass, and I know most people aren't doing that, and I never see anyone mention it so I doubt people even consider that it could be an issue.

It comes down to what you trust. I trust the stuff I can get from Debian's repos. I trust some other sources, and everything else I look at. I don't trust the aur, and I sincerely doubt most people look at the software they're installing from it to make sure it's legit.

It's really none of my business what others are comfortable with. The trustworthiness of where you get your software is a decision you have to make for yourself, and with the way people go on about the aur I get the feeling they don't bother to decide. I don't ever hear anyone acknowledge that there's any sort of difference between the aur and Debian's repos, but that's just frankly an utterly absurd idea.