The packages authored by distributions tend to be pretty good, but I've seen RPMs with nothing more than tar zxf in them and no tracking of the files installed.
The major package managers expect the package to manage the artifacts installed, this works if everyone plays nice and does their job...
The manager basically just defines a framework. Packages can abuse that framework in various ways (I haven't even mentioned install triggers, to execute code when other named packages are added or removed). There are a lot of ways to get it wrong, but when the dev builds a good package, it's almost magic how nicely it works.
$ touch now
$ install.sh
$ find / -newer now
That is supposing you trust install.sh of course.You can redirect the output of find to a file for later removal. You will have to filter out false positives from the 'find' output, usually dev nodes.
with a package manager suited for your system, or with the knowledge of what files the software in question touches.