Yeah, I search the AUR not to discover packages, but to see if something I want to install is in there, if it is I check the PKGBUILD and make sure none of the sources/commands/patches are suspicious.
People need to remember it’s not some carefully vetted app store and that they need to be the ones vetting any packages they install and any changes when updating.

For security disable password authentication - use public key instead, disable root login via ssh - use sudo or su from another user.

To reduce the number of attempts of others trying to get in change the ssh port and/or set-up fail2ban.

You could also set a firewall rule to only allow ssh from your IP address, if you have a static address at home and only need access from there, or have a way to VPN into your home network. Make sure you have a static address if you do this though, you don’t want your IP to change and be left locked out of your server.

Arch is good for tinkering with to make it your own, but can sometimes require tinkering to do things other distros can do straight away, e.g. adding udev rules to use certain devices or setting up zeroconf to be able to discover printers on the network automatically

If you want to be able to roll back changes easily you could set up your root and home partitions as btrfs subvolumes and use snapper to take snapshots, which can be combined with pacman hooks to automatically take snapshots when updating/installing software and can even be set up to allow booting into the snapshots which could be useful if you break your system