a) ensure this exact binary/script is GPG signed by someone I ostensibly trust
b) ensure it's not been tampered with by a MitM between the hosting server and my computer
This reduces my risk exposure to "creator of software X (or distro packager Y) has turned rogue", which is many orders of magnitude less likely than "website of software X got pwned, or someone is MitM-ing me".
Unlike a distro package you can also just -not- pipe it to the shell immediately and actually read it.
Even if you did unpack every distro package source before you installed it with the amount of crap and boiler plate you would almost never be able to work out -exactly- what it will do.
The way I see it the "curl | sh" people have found somewhat of a middle ground. It achieves similar convenience to "apt-get blah" but with simplicity level closer to binary tarball. It's almost as easy to work out what it's going to do as the tarball but it will also do it for you automatically.
IDK about other distros, but for the one I use (ArchLinux) it's trivial to inspect the install script, and they (PKGBUILDs) are usually well structured and easy to read.
But all of that is irrelevant when 99% of the Linux world is running RPM/APT.
You trust the distro maintainer and have a security mechanism to ensure the scripts and binaries have not been tampered with.
So virtually no risk of MitM and very little risk of malicious scripts and binaries.
Reading script and decompiling binaries does not imply you understand every thing they do, but it does imply that you have an unlimited amount of time which is impractical at best.