In all of these cases you also outsource the security to someone that you trust. How is that different from curl https... | sh ? Who says that no one took over

In all of these cases you also outsource the security to someone that you trust. How is that different from curl https... | sh ? Who says that no one took over the github, or the debian package?