That was my first thought. My second thought was that it's not much different from what we do all the time anyway, including when we download source tarballs and then run './configure'.
It is pretty amazing that someone is able to do this and a bunch of people actually do seem to be executing the builds before anyone else verified it.
But now that they have, it's no longer an issue, I guess...
I don't blame you. People seem to be playing it without a problem if it means anything to you.