@marcan the other benefit of a package (rpm) say from Fedora, not anyone can become a Fedora packager, you need a sponsor who trusts you. This could potentially be obtained via social engineering of course.

But of course in this case it's a macOS installer and I don't know how auditing brew packagers works 😊

But I generally agree some of the arguments around curl|sh are silly