Anyone who really complains about curl | sudo is just doing it for nerd points, because I guarantee you they happily install all sorts of other software without "vetting" it.
And if someone caught someone doing trickery it'd be big news.
If I don't trust the website to do curl | sudo bash then why do I trust the software that I would eventually install?
Even the old argument of "middleware devices modified the script en-route" is mostly removed by HTTPS everywhere.
And there are people like you who actually look at the script (and the compiled code, too!) to find things, because if they do find something in a script as big as HomeAssitant, they'll be famous.