What if the repo was malicious from the start just waiting for you to install the first safe version only to give you the trojan later? The shell script premat

What if the repo was malicious from the start just waiting for you to install the first safe version only to give you the trojan later? The shell script prematurely terminating isn't really a security concern and could be fixed by downloading and running the script separately. I guess my argument is that if you don't trust the source, don't install the application without looking through the code or running through some analysis software. I would say that sites that tell users to install software in this fashion should warn them about the dangers so people can make informed decisions.