You’re about to take his code and run it as a bootloader and you have concerns with piping a command into a shell?
At the very least, instead of the one liner give me a two liner: one to download to a file, then a second line to execute it.
Prepare to be impressed, the bootloader this installs to be able to boot Linux was first made for the capability of transparently running macOS under its hypervisor intercepting every hardware call transparently and streaming it to remote PCs to enable reverse engineering.
If you're intentionally verifying what's on the site via a completely separate independent method (which is what you need to do to actually verify what's on the site is what should) then it doesn't really matter what the instructions on the site say in the first place as you just decided you're not relying on them for the verification.
What is still needed but not implemented yet is hashes inside the served script for content it pulls from the 3rd party CDN. That said there is a reason it's alpha.