> Huh, so anyone who can access my web server can access the installation script?

"Obviously", the server should not be accessible from the public Internet while you're still doing setup. I assume it should still behind a firewall and you're accessing it by VPN. Only after you're happy with all the configuration and have the security locked down tight would you publish it to the world. Right?

Obviously you should lock it down. I'm just going off these instructions and how they might be interpreted.