Mostly the second, you should check what you're downloading and executing. But a server can send two different files on two similar requests, ans perhaps it sends you a "good" file when you view it in your browser and a malicious file when downloading it via wget.

When piping, there is a well-known trick how the server can detect the difference even disregarding stings like the user agent header, but that trick doesn't work when you do $(wget ...). But I won't guarantee there isn't some other trick that can be performed.