For helm and most other golang apps, you just need to download and put binary into your $PATH. They usually put them onto github releases, so it's really low friction way to install a genuine application.
Now to keep them updated is another story.
Now to keep them updated is another story.
We trust, or used to trust, distros for this. Why are they messing with the source?