Yes, it's insecure and is based on complete trust of the author of the script and the hosting provider, but there's an easy workaround: Don't pipe to bash immediately.

Download the file, inspect the contents and then if you're satisfied with what the script will perform, then run it through bash.