The malicious packages were found and removed quite quickly. Also anyone who doesn't blindly install from the AUR would have seen a suspicious .lol url. I suppose that a genuine package using a .lol url isn't impossible, it's just very unlikely,

These attacks do demonstrate the strength and weakness of the AUR, that anyone can upload anything at any time. The same as flathub and the snap store. Treat all of them with appropriate caution.