Packages in the AUR have some number of maintainers. When a maintainer no longer wants to maintain the package they can disown it, and when all maintainers do so the package becomes orphaned. An orphaned package can then be adopted by any user.
At any time there's a large number of orphaned packages in the AUR, and the attacker(s) targeted those.
At any time there's a large number of orphaned packages in the AUR, and the attacker(s) targeted those.