Cloud services do this to provision hypervisors and other infrastructure, the vms effectively do similar post boot. If you architect your management network well transport security should not be an issue.

The ‘piping curl into bash is dangerous’ meme is silly unless you’re actively reviewing shell scripts prior to execution. It’s no different to a git clone, pip install or npm update.