I think it's pretty common these days to have people git clone a repo and then build it. Not everything is on a package manager, and I see fewer new things on aptitude. At best, they're available as modules in npm or pip to be installed globally
In Linux, .sh installers are common. GOG games get distributed this way. If your wife still metaphorically slaps you when you mention .sh installers, it's only because she doesn't play games on Linux. She wouldn't know how to use apt either.
I think in the end the truth is that Windows is more targeted by malware because it's more widespread than Linux.