You're supposed to check the digital signature after downloading the install image. Other than that, it's the same as Linux. Windows has a lot of "unknown stuff too", but you can actually research the source code for OpenBSD if you're worried.
I think dfboyd was referring to the article author's personalization files (https://sivers.org/file/63.tar), not the OpenBSD distribution itself.
A tar file isn’t going to do much to your system...