Out of curiosity, what would be better to handle the case of RVM?

It's explicitly user space software, and unprivileged user space software at that, so having it require admin interaction (i.e. touching the system package manager) to install seems like a sledgehammer where a flyswatter would do.

They could use a VCS repo of some kind, but that doesn't handle the various folder and script installs that need to happen - and also doesn't help if there isn't that specific VCS on the system.

Upstream security is less of a concern since that hotlink just points to raw code on Github, and over HTTPS no less.

So what are the negatives here? For software like RVM, this seems like the best, most portable solution that works for the most people.

being on github and using https doesn't guarantee anything, obviously.

If you look at the actual script it contains a ton of sudo and also additional curl commands. The chain of security is very lacking.