This is something that worries me with a distribution like Alpine Linux.

It is hard to avoid a package like chromium [0] or firefox which are in the "community" repo. Now have fun check it at every update, this is not practically feasible.

For the web browser one can say we should use Flatpak anyway but there are a lot of other apps like sway from the community repo that cannot be flatpaked.

- [0] https://pkgs.alpinelinux.org/package/edge/community/x86_64/c...

But the community repo in Alpine is vetted and reviewed unlike AUR, which is a wild west.