> where's the difference between downloading a binary and executing it vs. downloading a script and executing

The difference is that the attack vector of the shell script is an easier target.

If someone was to be malicious; they could manipulate the script and inject some sort of payload in disguise. It's an easier vector to damage than say an compiled package. One that's less prone to being detected in that the script could go for days undetected.

With the executable you can compare the checksum and with the whole package compiled it is less prone and more tricky to alter.

Unless that script is under monitoring 24/7, I'm going for binary but they don't support BSD anyway.