I am not deep enough in it, but from the arch-announce mailinglist:

From the upstream report [1]:

openssh does not directly use liblzma. However debian and several other distributions patch openssh to support systemd notification, and libsystemd does depend on lzma.

Arch does not directly link openssh to liblzma, and thus this attack vector is not possible. You can confirm this by issuing the following command:

$(command -v sshd)

However, out of an abundance of caution, we advise users to remove the malicious code from their system by upgrading either way. This is because other yet-to-be discovered methods to exploit the backdoor could exist.

https://www.openwall.com/lists/oss-security/2024/03/29/4

What firefox version? It could be that you are using xwayland depending on your or your distros settings. Maybe try setting

$ MOZ_ENABLE_WAYLAND=1 firefox

https://wiki.archlinux.org/title/Firefox#Wayland

set -o vi / emacs works in bash too

According to the manpage --Yay --clean is the thought behind it, its a Yay specific shortcut for pacman -Rs $(pacman -Qqdt) Remove recursive what the Query quiet (short names) on the database lists as unrequired t

Now -Yc does not sound that bad.

It is still good to learn the verbose commands for pacman/paru/yay from the manpages, once you are familiar with them its easy to build more advanced commands for special use-cases.

multiple people warned them not to use arch.

My IT Bros said the same back when I had to choose W10 or Linux, they haven’t used arch and I had 0 Linux experience. I messed up every single step of the installation to a point where I knew from the problems I created what I did wrong. After many tries and a week later I had a working installation with dual boot. Never used windows and removed it a year later. It was rough but I learned how to recover from most errors a user can create.

If learning is the goal arch and arch-wiki is great.

SwayWM, but I think any of those you mentioned should be able to do it?

set -o vi