A brew recipe is a ruby program that can do anything on your computer. It will and does invoke any number of external processes, including: downloading and executing other recipes, running any number of compilers, arbitrary binary executables, and shell scripts, creating and linking executables, overriding system-provided binaries and libs, etc. etc. etc.

All these recipes and scripts are supposedly downloaded from GitHub. With supposedly anonymous user analytics: https://github.com/Homebrew/brew/blob/master/docs/Analytics....

isn't brew itself a curl'd script?

Installing brew is basically curl|ruby. But that's somewhat forgivable because you need to install a package manager before you can use a package manager.