It basically blindly trusts (and runs) whatever the website gives you. If the website is taken over or somebody messes with the dns, you'd end up executing the

It basically blindly trusts (and runs) whatever the website gives you. If the website is taken over or somebody messes with the dns, you'd end up executing the malicious payload. If this was a standard package, like the ones you get from apt, brew, npm, maven, pypy, or even a versioned binary, you have the option of verifying the checksum, pinning the version, analyze the package with a SAST thing like snyk, or whatever you are using, etc. Esp considering today's popularity of such attacks, more and more companies/teams are becoming more security-minded. Thus increases the desire for an installation process to be something more than just running a sh with full privileges.