I'm wondering about the security of downloading things from Universe. The Ubuntu help page seems to say that the community can make updates to pieces of software in that repo. Does that mean that just anybody can make changes, or that the maintainers of the original software can make changes?
For example, there's an instance of Discord maintained in Universe, so can just anybody edit that instance, or only the Discord developers? Or do I misunderstand the whole thing?
The repository is as secure as 'main' or any of the other three repositories.
Upload privileges are difficult to achieve (an accomplishment in themselves), and even if you are a MOTU (master of the universe, https://wiki.ubuntu.com/MOTU) you still need to go thru procedures just like any other debian/ubuntu repository. There are loads of wiki pages (eg. https://wiki.ubuntu.com/UbuntuDevelopers more defined than the wiki page you linked which was a community page too), and if you know debian rules, it's pretty much the same.
A big part of it is reputation, being open-source anyone can view almost everything that was done; even discussions & meetings are mostly public & recorded via IRC logs. If someone has proved themselves to be worthy to achieve MOTU, one wrong upload (which cannot be hidden unlike closed-source software) will very quickly be detected (though should have been detected in review before then) & all work done over years to achieve MOTU is gone, privileges gone & reputation in tatters. People trusted & respected enough to have achieved MOTU status don't want to destroy all their work/reputation.
In a podcast, three devs were asked about creating a April Fools joke that was only a message for a few hours (debian-ubuntu/solus/elementary) and Martin Wimpress (Ubuntu-MATE/debian) spoke clearly about this (my last paragraph is a reword of some of what Martin said 1-3 years ago on that podcast). All three spoke of their reputation and why none could imagine any developer having proved & gained those rights, would destroy it by misusing it.
If you don't trust it, all uploads are very public, and you can inspect them very clearly. As I'm also in IRC rooms, I get to see various discussions about uploads before the upload actually happens, so it can be seen in real-time.
Yes it involves trust, and I do trust MOTU's, far more than closed-source developers who can hide by nature that we never get to see what they do, never get to really evaluate how much they stuff up etc.
