Of course there's always going to be attack vectors, but clearly it's safer to execute a known program (Firefox) from a trusted website (firefox.com) than it is

Of course there's always going to be attack vectors, but clearly it's safer to execute a known program (Firefox) from a trusted website (firefox.com) than it is to use an unknown program (Jons Legit Calculator App) from an unknown website (some bit.ly link). Sure there's still attack vectors at play, but you've mitigated the easy ones. This is the same thing. Everyone needs to know not to go copying terminal commands unless they really trust the source. Obviously there's still a security issue there, but its significantly lower, and that's really all we can aim for.