You're not wrong about the curl install method, but expecting projects to get into distro repositories just because they want to is unreasonable and if they ran their own little package repo or just distributed packages from more manual install, many of the same dangers and other problems with curl-to-shell methods could still be present.