[Macha]

a) curl pipe to shell

b) Download a DMG, double-click to install

These are not morally that different, the DMG installation can also do pretty much whatever, and I doubt people are picking apart the DMG to find the install script to verify that either.

[quesera]

I'm definitely not resuscitating that old argument here.

Just noting that people have strong opinions about the preferability of either approach.