There is a difference between downloading, say, the Docker install script from docker.com and opening a random email attachment and that is that I trust docker.

There is a difference between downloading, say, the Docker install script from docker.com and opening a random email attachment and that is that I trust docker.com. If I don't trust docker.com because I think it might deliver malware in the install script or a poorly written install script, then I shouldn't use Docker because why would anything different apply to their main software. If I don't trust docker.com because I fear it might be hijacked then I shouldn't use Docker because who guarantees me that their source code or any derived binaries aren't also hijacked.