Not sure if sarcasm or actual disinformation. You’re not supposed to trust the aur, that’s kinda the whole point of it. The build scripts are transparent enough to allow users to manage their own risk, and at no point does building a package require root access.
Not just mp3, all lossy audio formats use psychoacoustic analysis. That’s how they figure out which data to throw out.