Getting it out of a repository wouldn't make any more vetting appear as if by magic.

And if you're facing an attacker sophisticated enough to send different contents to a browser and to curl, then you're probably not going to find their backdoor in the first place. And it would be stupid of them to depend on that trick, so this becomes an extremely niche case not worth worrying about.

And multiply that sophistication by a hundred times because this is on github servers.

The "what if the file is truncated" issue is the only realistic one, and competent installers like this one define functions and don't run them until the last line.