In this context, orphaned doesn't always mean you should remove it. It just means that nobody in AUR is taking responsibility to keep it updated. You still might have other packages from the AUR that depend on this one.

Since it is unmaintained, basically anyone can now claim ownership of that package in the AUR and push updates for it. Theoretically, someone could try to distribute malware in this way.

This is why it's important to check the diffs of your AUR updates.

Yes those are leftovers. Khotkeys got replaced with kglobalaccel - safe to remove but install kglobalaccel. Krunner5 is replaced by krunner, kquickcharts5 by kquickcharts. For kpeoplevcard i don't know

Define safe. Your can recover from just about anything with a live USB by just reinstalling any missing packages. But that is only needed if you remove some vital packages, those in base or to do with your bootloader. Which is only a small list. And none of those will be in the AUR unless you explicitly opted into something critical (like zfs as your main filesystem, or a custom kernel).

Most things, especially GUI stuff is optional in Arch. You might break your GUI but you should always have access to the CLI to reinstall things like you did when you first set things up.

The only time I would be really wary is if trying to remove a package also tries to remove half your system packages. Then it is more likely to be required by something you want and should very carefully audit the list of packages it wants to remove.

pacman -Qtdq

Unfortunately, you're going to have to go through the list and decide whether you need each one

That used to be in the repositories I'm pretty sure and the aur package is pretty new, so I guess yay migrated it to use the aur one somehow instead of replacing it with krunner for the plasma 6 update?

And that probably applies to those others too