Of course copied binaries can cause plenty of trouble too, but I have much less of a reason to give an installed program admin privileges than I do an installer.
I prefer this one: https://mothersruin.com/software/SuspiciousPackage/
But I’ve used both at different times with equally great results.
In our case, the CLI is part of a data sync system, so it does need a "special" once-per-hour check for new data (keeping local and mobile in sync).
I've actually been surprised how strict Apple is before it will happily let signed code run. But the average user (including me previously) doesn't know that. I think trust comes down to being clear up front.
Note to self: Add extra details/options to installer (WYSIWYG)
The MAS version has only one of those and it works.