I think he told me this so I would get into the habit of doing it. I was so used to just clicking on an executable file and just installing the program without

I think he told me this so I would get into the habit of doing it. I was so used to just clicking on an executable file and just installing the program without ever thinking it may contain malicious code. I can tell you I don't do this every time. Now if I'm installing a 3rd party extension or plugin, I usually do it in a sandboxed environment, run some pen tests on it to check how secure it is and see if there's any malicious code before I install it on my machine or server. And yes, even then, it is still possible to install malware on your machine.