Sure but that’s true of any packaging system. The .deb or .rpm you just downloaded off not-a-scammer-honestly.com could just as easily be malware.
That was in 2018…
https://www.bleepingcomputer.com/news/security/malware-found-in-arch-linux-aur-package-repository/
The AUR has the same risks as adding a ppa to a debian tree install, or downloading an rpm from a website.
If it’s not in the official repository of your repo treat with caution
Your odds of getting caught are extremely low, but if you are you will be deported and have your visa cancelled (as an Aussie our border guards really do suck I’m sorry). I genuinely wouldn’t risk if it you’re moving here. If it was just a holiday and you didn’t care too much about getting banned then sure, but definitely not worth risking a work visa on.
The lowest risk way is to put it on a cloud drive and download it on arrival in Oz.
It forwarding opens a port direct to your system from the vpn ip.
So if your internet address at your router to your ISP is 1.1.1.1(which NATs it to your PC address on your lan) and the vpn exit address is say 10.10.10.10
Then when you port forward a port, say 443 (you wouldnt) then any request to 10.10.10:443 would then go to 1.1.1.1:443 and then to your pc on your lan.
In short it allows a direct connection through the vpn
Edit
Technically that’s slightly incorrect,
packet goes on 10.10.10.10:443 but it goes to the PC directly through the vpn tunnel. The port it goes through the 1.1.1.1 router to the PC on could be anything, it won’t necessarily be 443. It will be whatever the vpn is set to use
True we say 15th September, not 15 September