> This is no worse than if you were to have totally-not-evil.example.com give you the bash script on a floppy disk or something.
In practice, perhaps. But detecting whether the file is being piped to bash (and not cat/less/grep/etc) is pretty straightforward.
https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...