I mean, untarring a downloaded tarball from somewhere and running `make` is just as dangerous, right? Only there you can make sure the checksum matches, but people skip that step all the time.
If the tarball is not pgp signed by the author (e.g. Bazaar and Tor Project do that), checking the checksum is basically checking if the server you’re downloading from didn’t have any silent data corruption (see recent KDE hosting incident), because in transit TCP does its own checksumming anyway.
* When copying from the web, what you see on the page might not be what ends up in your clipboard,
* When pasting into a terminal, any text with endlines will execute immediately.
As a result, just pasting anything from the web into a terminal window might execute arbitrary code, without any further action on your part.
Good luck with that though. (Escpecially with things like, I don't know, browsers.)