From a security perspective, I don't trust the binary that downloads and installs a package to just download it. Some package installers, such as Bundler, like

From a security perspective, I don't trust the binary that downloads and installs a package to just download it. Some package installers, such as Bundler, like to run arbitrary code from the package on install. I don't trust that to not be invoked with a simple download. I'd rather use hardened tools like CURL or a web browser. It's just good security hygiene.