Yeah, that's great!

Imagine we would download random code from the internet and just execute it, like with NPM, PIP, Maven, Cargo etc.

cargo/uv/go have lock files though

Or npm being allowed to run arbitrary post install scripts

I don’t think that matters as it’s usually curl | sudo sh

I literally ship an installer that runs with curl | bash... reading this thread while patching my servers is a fun experience lol