All you need to verify an AUR package is to read the PKGBUILD file, which is something the AUR keeps on encouraging you to do (this assumes that you trust the upstream repo, which is something that even official packagers of most distros do)
Also a lot of flatpak packages aren’t sand boxed enough to be safe and only ends up giving false sense of security to nontechnical users
Your last point is extremely important though, AUR is horrible for nontechnical users (which is why the AUR discourages AUR helpers)
All you need to verify an AUR package is to read the PKGBUILD file, which is something the AUR keeps on encouraging you to do (this assumes that you trust the upstream repo, which is something that even official packagers of most distros do)
Also a lot of flatpak packages aren’t sand boxed enough to be safe and only ends up giving false sense of security to nontechnical users
Your last point is extremely important though, AUR is horrible for nontechnical users (which is why the AUR discourages AUR helpers)