1. You asked what is handing out points, automated was my answer only on points, nothing else, how it decides, I can't tell, I'm not a coder, just a theorycrafter. The idea is that untrusted people will have their submissions to be manually vetted by AUR mods at the earlier stages, hence why I said "and secure against abuse via combining it with further manual interventions".
2. Btw I thougt you'd know: 2FA
3. I wasn't affected, but didn't miss the news, I was an MX-Linux user back then it happened, but they weren't affected thankfully. Now I'm an Arch base user (Garuda); Thankfully I'm still unaffected by these new attacks, because I use IgnorePkgs, and only have 2 AUR pkgs for my printer, which was updated in ... forever But still, there should be some extra safety layer, at least some bare minimum, for people who don't know how to read or what to look for in the PKGBUILDs or how to understand them.

Ok, then we're full ears of what idea can you throw in to the common bin to mitigate that.

You're totally missing the point, which - still - is, that I'm giving ideas, to reduce the attack surface, and that's why I said the list is an as-is proposal. One thing I know is that every problem has a solution, although not a 100% perfect one. Since brainstorming is open to everyone, we're not here to shoot down each other's ideas, but to build a safer computing environment for everyone's daily life.

That sounds cool but preventing automated sybil attacks or long-term sleeper accounts requires multiple layers, which is why a trust system must be combined with active anomaly detection (and manual inspection too) rather than relying on a single silver bullet, it is true that no system creates absolute blind trust, but reducing the volume of low-effort malicious adoptions allows both mods and users to focus their manual vetting where it actually matters imho.