this + fish...if someone installs them via installer rather than building from source, is that a security risk? Meaning, is fish so powerful that a compromised

this + fish...if someone installs them via installer rather than building from source, is that a security risk? Meaning, is fish so powerful that a compromised version of fish could scrape / intercept GPT comms and either prime GPT networks or disturb them?