I believe (@arojas may wish to correct/clarify) that this package is/was a transitional support package, to allow certain KDE applications to be able to keep using some of the deprecated KDE5 APIs while they transitioned to becoming fully KDE6-compatible. (Qt has a similar library.) I am not sure what apps still require it, if any; On Gentoo I found it was no longer required by anything I use, I think at least as far back as kde-6.6.0.
I haven’t followed the Arch debacle closely, but I believe it concerned “orphaned” packages that had been languishing without any maintainer for some time, allowing the baddies the opportunity to “claim” and corrupt them. It seems unlikely that would apply to this package. I don’t have a link for you, but I believe a script was made available to check your system against the list affected in this attack.
That said, given what the episode has revealed about the AUR in general, I advise you to examine every PKGBUILD you install, including updates, every time!