I assume OP's point is "you're running a random script directly into your shell!!"
You're about to install and run their software. If they wanted to do something malicious, they wouldn't hide it in their plaintext install script.
You're about to install and run their software. If they wanted to do something malicious, they wouldn't hide it in their plaintext install script.
A server can use this to maliciously give you malware only if you're not looking at the code.
Though your point about trust is valid.
Sure a binary can be swapped in other places, but they generally can be verified with hashes and signatures. Also, a plaintext install script often has this problem in another layer of recursion (where the script usually pulls from URLs that the runner of the script cannot verify with this method)