[quesera]

0. Thousands. Tens of thousands, probably.

1. True of any download link as well.

2. See 1.

3. See 1, unspoken comparison to trusted package archives excepted.

4. Yes, getting your software into an official publishing channel is preferable, but not automatic, not immediate, and not without update latency.

I'm 110% with you on hating pipe to shell, however. Your arguments don't really address the issue.

And note also that you can just clone from github if you don't like piping to shell. And nothing prevents you from packaging it yourself in your own trusted repository. If you run serious infrastructure, you already do this.