No user should ever be urged to install anything with that method, it's unsafe.
Do you have the mental fortitude to format it and go through it line by line looking for possible exploits?
It's 100% trivial to have it run rm or shred on all files you have access to while simultaneously printing correct looking install progress messages.
I see how flatpak is an improvement, but I don't see how piping into bash is any worse than "install this .deb file / npm package / pip package." If the package author wanted to do something malicious, it's just as easy (if not easier) to put the malicious code in the package itself rather than a bash installer for the package.
If we're considering the same batch script: You can read it,it before running and be sure that the endpoint doesn't dynamically give you different results depending on how you fetch it.
In either case, the proposal here was flatpak, which does provide security benefits like sandboxing.
> It's 100% trivial to have it run rm or shred on all files you have access to while simultaneously printing correct looking install progress messages.
The same is true of the tool itself, too.
How is installing something from Homebrew any more secure?