There's also the fact the installation instructions of way too many open source projects consist of piping code downloaded from the internet straight into bash. A lot of people are probably used to doing that: they assume it's trustworthy just because it's open source and on GitHub. It's the perfect vector.