If you can't trust that, then I suppose you're checking every node_modules dir for any malicious codes but I guess you're just being allergic to pipe bash.
I don't like `curl|bash` not because it's insecure but because I don't know what it's doing to my system, and I don't believe that it understands my system properly. Ideally I'd download a single binary and put it in /usr/local/bin myself.
If you don't trust bun.sh don't do it. They would be torpedoing their project if they put something nefarious in there though, and it would probably more effective to put the nefarious stuff in bun directly. Yes a 3rd party could have gained access to their site and modified that script, but that's covered under "trust bun.sh".
It's also a short, clean and easy to read shell script.
Can you walk us through an alternative and why it would be safer?
You have it backwards. Even Microsoft posts install scripts such as this for DotNet.