This kind of comment reeks of idealism. Sure, you can look at every single thing you install because of the OSS nature of Linux, but you are incredibly naive if you delude yourself into thinking a) that you have the bandwidth do to this and stay meaningfully productive, and b) have the technical abilities to sufficiently evaluate what each piece of software does.
This take is reductive and should not be taken seriously.
edit: Editing to say, I do agree with the OP in spirit, you should try to avoid running untrusted software. But the devil here is in the details, it's simply not an easily feasible goal.
I agree. But I think we shouldn't equate the fact that we-have-the-technical ability-to-do-this with we-have-the-bandwidth-and-the-skills-required-to-do-this.
The discussion was a comparison against the security culture in Windows. Source availability is a sort of bare minimum at least, obviously by itself thats not enough one wants the source to have been crosschecked by lots of eyes.
My personal opinion regarding security I would say is easy ability to apply sandboxing at various levels on the user side for software we trust less. (By user side I mean not depending on the developer to package the app a certain way etc. A virtual machine or a chroot jail etc are examples of what I meant by this).
My point isn't that you should review the scripts you download to install as much as it's that you should avoid using those if you actually care about security. They are, in every single case that I've ever seen that they're not actually nefarious, merely convenience methods that automate a bunch of manual steps that are outlined in instructions which you can also follow.
And that's in the cases where they (or trusted third parties) aren't actually packaging it already for more normal installation in the OS you're on.
So, I'm not being idealistic and saying "read the code of everything you run", I'm saying "realize that running random scripts is equivalent to running random executables in a lot of cases, so maybe don't do that no matter the OS, as it's not an OS problem and one OS won't really protect you regardless of whether it's Linux or Windows or Mac OS", and thus it's not really a Linux problem at all. As an example, I'll leave you with this[1], which I find fairly relevant since it has the powershell equivalent if curl piping to bash.
Nowadays, you can also mostly life with just choco install on Windows. Not as well vetted as Debian packages, but a lot better than google.
But that only helps power users. On linux learning these things is simply a necessity because installing things outside your package manager is even less user friendly.
I wonder how many preinst/postinst scripts are being read by apt users prior to install/upgrade? These run as root, making them a bit worse than the typical curl|bash after all.
You have so many more practical options for even amateur security auditing on Linux. You can trivially spin up a temporary OS/chroot/container and run your specimen inside it, or run it under strace and log every system call, or statically sift through an executable for strings like IP addresses in an instant using basic tools. Bash install scripts can simply be grepped. It's an environment that gives the user control by default, and as such it's that much harder for executables to gain the upper hand.
Obviously you don't do that for every binary you run, but you have options if there's something you're a bit suspicious of.
This take is reductive and should not be taken seriously.
edit: Editing to say, I do agree with the OP in spirit, you should try to avoid running untrusted software. But the devil here is in the details, it's simply not an easily feasible goal.