Isn't the whole point of this comment thread "vulnerabilities to supply chain attacks"?

>> - Downloads binaries for use in build with no hash/signing verification.

> It downloads them using TLS.

If the binary is updated to a shady version, sure, no one will be able to tamper with the download, they're certain to have received the correct shady stuff.