It basically blindly trusts (and runs) whatever the website gives you. If the website is taken over or somebody messes with the dns, you'd end up executing the malicious payload.

If this was a standard package, like the ones you get from apt, brew, npm, maven, pypy, or even a versioned binary, you have the option of verifying the checksum, pinning the version, analyze the package with a SAST thing like snyk, or whatever you are using, etc.

Esp considering today's popularity of such attacks, more and more companies/teams are becoming more security-minded. Thus increases the desire for an installation process to be something more than just running a sh with full privileges.

Whoever terminates this http request gets to run arbitrary code on my computer that I haven't read, in the context of my user

You're trusting somebody to run random stuff on your machine and you're trusting them to not do something like this: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...