Auditing the script can certainly help, just not against malice. E.g. if the script is not set up in such a way that it protects against partial execution, the

Auditing the script can certainly help, just not against malice. E.g. if the script is not set up in such a way that it protects against partial execution, then this represents a kind of vulnerability (truncation) that signed MSI/.deb/etc files simply do not, by the design of the file format. Yes, it's possible (even easy) to write a curlbash script that doesn't have this issue (or the various other issues). Reviewing the script still buys you something.