Stupidly low friction. Consistently failing to learn from the mistakes of package managers is bad enough. Failing to learn from your own is another level.

“Learning from your mistakes is good. Learning from the mistakes of others is better”.

For all its flaws, at least Cargo attempts to do that. AUR does not. No other package manager this regularly has hijacking problems.

Both. And that's an even worse combo, making stupidity frictionless.