being on github and using https doesn't guarantee anything, obviously.

If you look at the actual script it contains a ton of sudo and also additional curl commands. The chain of security is very lacking.