Why do people use AUR after the incident?

hi, I'll possibly be an Arch beginner, and I was under a rock, when the incident happen. I'd like to ask this: what’s point in using AUR, if that’s not official and it has such high risks as it was in the incident? If I were using Arch, I would use the AUR probably only in an isolated environment like a virtual machine, but maybe I'm wrong and don't understand a minute detail, so, I'm here