That doesn't protect you from truncation attacks: almost no server out there sends a close_notify before closing the TLS connection, so few tools will throw an error when you receive an incomplete file.

It may be hard to exploit, but executing a script before you have completely downloaded it is simply a really bad idea.