TL;DR: starting with 5.6.1-2, XZ is safe on Arch. Safe as in not affected by this particular vulnerability.

Look here: https://gitlab.archlinux.org/archlinux/packaging/packages/xz/-/commit/881385757abdc39d3cfea1c3e34ec09f637424ad

And here: https://security.archlinux.org/ASA-202403-1

5.6.1-2 is where the package switched from building from the tarball (backdoored) to the upstream git repo (clean). The tarball release contained some extra build instructions (which didn't exist in the git repo) that added the backdoor during the build process. The issue arose from the downstream maintainers' assumption that the contents of the tarball and the git repo were identical.

Subsequent changes, and 5.6.1-3, were mostly administrative, like changing the git repository's URL (since the maintainer's github account was banned) and locking out Jia Tan's PGP key.

an article which said that in 5.6.1-3 the backdoor was “fixed” by just not letting the malware part communicating with the vulnerable ssh related stuff

That article is bullshit, don't believe a thing it says. Arch was not affected by the SSH vulnerability because the sshd binary did not link liblzma where the backdoor existed, so they could never communicate in a way that could be exploited by this particular vulnerability. It was not part of the fix.