It's still executing code right from the internet without any checking. What it does fix is one of the ways in which a server can tell that a script is being executed and not just downloaded for reading: when piping, the download stalls while the shell is slugging through the script, but when it's done in a shell escape as here, it's downloaded in one go. So theoretically, you have less chance of reading something different (when inspecting the source) than what the shell is going to execute.

However, the script can't be overly long this way, since there is a limit to the command line length on Linux.

Safe, however, this is clearly still not.