I know of the attack. It's very unlikely to matter in practice.

There's a ton of potential issues when you're curl-piping; all those issues are present in some form when you're simply doing curl first then sh.

It's far more egregious to download a hard-to-inspect binary then run it, than it is to download a shell script then run it. Although it's harder to inject code on the fly, if you're at the stage where you're worried about these kinds of attacks it makes very little difference.

I don't see people bitching about https://www.terraform.io/ offering download links for example. So yeah, it gets tiresome to always see "oh! curl|sh! boo! bad!" - there's actually no better way of sharing such scripts short of making and vetting a package with a high-entry-bar distribution. And a two-step curl + sh instead of a pipe is security theater.

https would certainly be appreciated on that site but that's a general issue, regardless of the download script.