To be fair, for Windows and many Linux distrubutions (don't know about OS X) have signed packages, so it's not like they're grabbing any data and blindly running it.