The problem is that:

1. The effort and care needed to test is unnecessarily high. You've got to guard against way more tricks from an interactive source that can see you and choose what it's going to deliver and how.

2. With no "standard" artifact that can be exactly compared, that work cannot be shared.

In contrast, release_1.2.3.zip isn't going to mutate under you and everybody can agree on what its size/hash/bytes ought to be, and if it deviates from that it sets off alarm-bells.

> curl | bash scripts all define a function and then call it on the last line. This is a non issue in the real world.

Why would a convention often followed by good/careful actors bind what malicious/careless people create?

Please take a look at this before making any assertions... https://github.com/omlahore/RemoveMacAI/blob/main/install.sh

Isn't that a bit like shutting the stable door after the horse has bolted?