AUR malware

Really, something like this ever happened lol?

To add to what you said, I would like to add that there is a great app on F-Droid that centralizes way to see all devices and which ROMs/custom recoveries a particular device support, XDA thread for specific device, download links to specific ROM for specific device etc, so it saves you a lot of time.

Does it matter where will I buy my Pixel phone from? Where did you buy yours? If I will buy any Google Pixel model, I want to be sure its bootloader can be unlocked and I won't get any "surprise" after the purchase.

I'm thinking about buying Google Pixel 5 or Google Pixel 7 Pro (or maybe better ones), because these models from what I've seen have the support for highest amount of custom ROMs and Google Pixel 5 supports TWRP.