i kinda have an opposite take, well ofc both are not safe, but once you have verified what you're about to run, with AUR you get the additional ease of removal, and tracking of files that will be added
i've seen a few curl | bash trying to edit my shell rc and put stuff in my home folder, which just gives me the yuck
now obviously, i won't recommend either to anyone who doesn't know how to write bash and PKGBUILD themselves, but if i'm comparing these two, i find AUR way more manageable