I think about this every time install instructions for something are “run this terminal command to add our repo to your sources”.

Or when there’s an installation option that’s just piping curl/wget into bash, like curl -sSL https://install.pi-hole.net/ | bash

It’s super convenient! But risky. Even if the fetched script is legit, the command is still one typo’d URL away from fetching and executing something entirely different (imagine squatters sitting on install.pi-hole.com instead of .net and serving a malicious script)

I appreciated that pi-hole was (and still is) transparent about the drawbacks of this installation method when I installed it years ago.