I use Plasma 6.7 so using a Plasma 5 package from the AUR must be a problem, considering the recent attacks, right?
plasma5support is neither a Plasma 5 package nor an AUR package and no, you should not remove it.
What is the meaning of that “5”?
I believe (@arojas may wish to correct/clarify) that this package is/was a transitional support package, to allow certain KDE applications to be able to keep using some of the deprecated KDE5 APIs while they transitioned to becoming fully KDE6-compatible. (Qt has a similar library.) I am not sure what apps still require it, if any; On Gentoo I found it was no longer required by anything I use, I think at least as far back as kde-6.6.0.
I haven’t followed the Arch debacle closely, but I believe it concerned “orphaned” packages that had been languishing without any maintainer for some time, allowing the baddies the opportunity to “claim” and corrupt them. It seems unlikely that would apply to this package. I don’t have a link for you, but I believe a script was made available to check your system against the list affected in this attack.
That said, given what the episode has revealed about the AUR in general, I advise you to examine every PKGBUILD you install, including updates, every time!
Could have a more precise name, like PlasmaLegacySupport or something like that.