An unsigned deb is better than an unsigned script as it keeps track of what files are deployed and you have a version number in a central list from dpkg -l Sur

An unsigned deb is better than an unsigned script as it keeps track of what files are deployed and you have a version number in a central list from dpkg -l Sure something bad can still do things, but it tends not to splat files everywhere with no trace.