The people who would vet the code before execution are experienced enough to change it from curl | bash to curl > install.sh and then read it before executing. The only thing you can, and should, criticise here is the delivery over HTTP instead HTTPS. Delivering any kind of code over HTTP is completely inexcusable since the introduction of Let's Encrypt.