Indeed; that was my point exactly. People complain about things like "curl https://sh.rustup.rs https://sh.rustup.rs | sh" from the Rust homepage, but it's esse

Indeed; that was my point exactly. People complain about things like "curl https://sh.rustup.rs https://sh.rustup.rs | sh" from the Rust homepage, but it's essentially the same as trusting "cd vim && ./configure && make && make install" (plus, if I would hide anything I'd do it in the probably quite large binary that script downloads, which is much harder to audit).