CachyOS does pull some packages from the AUR into the CachyOS repo, but they state that they go through a validation process first.