For my use case, the details of the userland CLI is mostly irrelevant (particularly since I maintain a FreeBSD server, which means I’m reasonably familiar with both BSD and GNU styles of these tools). Most of the time it just needs to exist, not be any particular version, and exceptions are handled well by Homebrew. Third party apps with UIs being up to date is more important.

the AUR is user supported, no claims are made, but AURs are built off of short scripts called PKGBUILDs so it's easy to audit, you're gonna want to look for the line that links to a tar archive or git repository.

Nobody, but the specs are so simple you can audit them yourself usually. For me it's mostly about low friction packaging my own software tbh.