That's why you need to inspect the script.
And if I—an evildoer—leave the script alone and simply replace the installed binaries with compromised ones?