Adoption of unmaintained packages to maintain them is not a mistake. The problem is the current implementation, not the idea behind it. It's like saying the AUR is a mistake, because some people do malicious stuff.

They should find a better solution, like adoption shouldn't be granted to everyone without question, especially new accounts who didn't maintain anything before. Mass adoption shouldn't be granted automatically (limit rate), in example 1 package adoption per day and if someone wants more, admins or moderators need to approve. And updates of newly adopted packages should wait a day.

Also the AUR helpers should do a better job. Always ask if a new adopted package should be updated and give a warning the maintainer changed.

Remove unmaintained packages and block the name for several months.

Alright, but that would mean most of AUR. Have a look at the package statistics box on the AUR homepage. Most packages fall under that definition in one way or another. The vast majority of the AUR is package some random person added once then never bothered with ever again.

Frankly I'm surprised that the AUR has survived for so long in its current form, for what is basically a shell script distribution system with zero supervision and zero safety guards.

Well, just don't use AUR for everything. They don't even recommend helpers. It's ment to be tedious, to discourage usage for non-necesarry bullshit.

Is anybody really recommending Arch to new users though?

Arch as far as I am aware has never been recommended to new users. Sure their is CachyOS and other variants. And on top of that AUR you shut read the build scripts. But I suppose not many people do that unfortunately.

You mean https://aur.archlinux.org/packages/deepseek-tui-git from the list https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/P4WIRHTFNH2YZWQHGBAKQWX5YOAFIDLY/ ? It has 0 votes and Popularity is at 0.000000, since it was uploaded 2 months ago. And there is a non Git version that is not listed (probably not affected) at https://aur.archlinux.org/packages/deepseek-tui . On top of it, on their website https://deepseek-tui.org/#install the main recommended way to install it is with npm and there is even a way to build it with Rust it seems (I'm a bit unsure).

So I don't think it hit that many users, as only a couple of people since Mai would want to install it, and they have to have updated it to build from source in recent days. That is a very narrow number of people, just by my gut feeling.

Not if you follow the normal safety precautions for using the AUR. There are several things you can do to look for red flags, but the most essential thing is to read the PKGBUILDs. And helpers like yay, paru and Shelly can all show diffs which makes that much easier after the initial installation because in most cases you'll just see that the version and checksum has changed which means it's as trustworthy as last time.

This has always been the case, and will continue to be the case unless the Arch team restricts the AUR which quickly can make it lose exactly what makes it so good.

What's the alternative?

You don't have to use AUR to use Arch. Just like PPA for Ubuntu or Fedora's Copr.

Same. I was on Cachy for a few months but recently switched back to Fedora. I'm sleeping very peacefully.