What does it do about the curl|bash itself downloading software at runtime?

That's why you need to inspect the script.

	▲	stouset 2 days ago \| parent [-]
		And if I—an evildoer—leave the script alone and simply replace the installed binaries with compromised ones?