With things like this that come from reputable sources, it's not unreasonable to put some trust in the source and some trust in the smaller percentage of developers who actually read the source code.
Even so, assuming you want to be extra careful (you're installing it on a development machine with highly sensitive information), it's not that difficult to clone the repo and edit the install script to install from your local copy of the repo.
Although I suppose it is possible that 37signals' GitHub account was hacked and someone maliciously designed a convenient Rack server and website with the intent of targeting the lucrative Rails developer demographic, or that the package the installer downloads is an insidious 37signals trojan not built from the code at the public repo.
Point taken.
It seems stupid, but on the other hand I never see people abusing the sticky bit, possibly as a result of the higher barrier to entry.
On the other hand, it causes me inconvenience every time I want to do something legitimate with it.
It is not really a script vs. binary issue so much as protecting against how scripts are loaded.