Author here. I figured it was an easy enough hole to fix that it was worth including. The ZSH line editor will paste without sending the command so you don't really harm usability.
Installing dev tools via paste and pipe into sh is fairly common:
curl https://sh.rustup.rs -sSf | sh
The overall risk is probably really low, but there's no downsides.
Cool, I’m sure that’s good advice! I’ve just always been curious about the general question — there’s a large contingent of programmers who role their eyes whenever they see curl|sh and there’s probably an equally large component who think that life’s short and contains more important issues than command line security neuroticism...
Installing dev tools via paste and pipe into sh is fairly common:
The overall risk is probably really low, but there's no downsides.