Dmg isn't scary. It's just a disk-image that mounts upon download. You have to manually start any executable on it.

And yes, there are users who click on executables carelessly, but those aren't scared by url-parts.