Author here. I figured it was an easy enough hole to fix that it was worth including. The ZSH line editor will paste without sending the command so you don't really harm usability.

Installing dev tools via paste and pipe into sh is fairly common:

    curl https://sh.rustup.rs -sSf | sh

The overall risk is probably really low, but there's no downsides.