AUR isn't a traditional repository but more functions like a paste bin for package build scripts you have to go out of your way to enable and use at your own risk. It is not how actual Linux repositories work which are way more safe than google or even apple app store.
> way more safe than google or even apple app store.
Probably because of how people submit directly to the commercial app stores and the app store staff are expected to accept them as long as no malware or other problems are detected. Such problems are generally explicitly listed on Terms of Service and app submitters may be able to dispute rejections. Meaning problems generally need to be concrete and justifiable. Also, because of the sheer number, problems are likely scanned for, rather than each app being personally considered by a developer.
FOSS distro package repo maintainers generally don't have any such pressures. They get their absolute pick of what to include from the wild, only taking as much as they're able to handle.
Also, distro repo maintainers handle the building from the source code themselves, while app store apps are closed source to the app stores. Their ability to inspect apps is very limited.
If something bothers me with my phone's UI or if I want to change the behavior of some system service, I can do e.g. "apt source phosh", patch it and then "apt build-dep .", "dpkg-buildpackage -b" and "apt install" it right on the phone. I can even send the patch for upstreaming from there.
How easy it is to do an equivalent thing on Android?
UI-wise, termux can run Xorg and you can modify the interface you use there. You're right about services. Can't run systemd, but they can just run the service programs in the background (e.g. they can call sshd directly). Regarding modifying programs, maybe not that convenient directly on termux, but if it's rooted, you may be able to run docker and modify them in a debian environment.
The neat thing about non-Android phones with respect to what you mention is that you can do those things just like how you would on any other computer, without having to worry about Android workarounds that may one day stop working via an update.
"interface you use there" - yes, with a strong accent on "there". Sure, you can even run a x86 emulator in a browser and run anything you want there as long as it's performant enough, but that's a very different thing to actually controlling the OS you run - and even if you do happen to be in some control, modifying anything in Android without reflashing the entire thing is still a massive PITA. And of course you're not gonna pass the attestations once you assert the control anymore, so why not just ditch Android completely at that point?
It's difficult to just do things. Even windows feels more "free." Phone OSes are built like prisons.
Ideally Android would let you drop into a real shell, without having to deal with android sandboxing.
Regardless, I use termux and tasker to get my automations done.