But do they need to have the issue? Why allow running arbitrary commands during install?

To me it is less about someone purposely including malicious code (since yes, that could be in the project itself not just the install) but that having this willy-nilly form of package managing opens up people to mistakes moving files around that do harm on accident.

And it gets even worse if the package is able to be added to a repo, like npmjs.org, and not have to be accepted after being reviewed.

Rust/Cargo, homebrew, probably a host of others.

Well, to rubygems's credit they know post install scripts are a bad idea and they don't support it. The only way to do that in a gem is a hack based on extconf.rb (the original intent of this file being to compile native extensions).

But yes ultimately you are right.