I wonder how popular these packages were. Librewolf and Firefox sure are popular, so this sounds scary, but for example searching for "firefox-patch-bin aur" yields no results, aside from sites talking about how it contained malware.

My impression is that the malice was spotted timely, and not many people were affected. Which is a pretty good thing!