I have a vague memory of some project that did this ages ago where you could see the script on their web page but when you ran the command it executed a different script (there was a single-character difference in the URL) and the result was it told you not to be so dumb as to run scripts like that.

It is still the recommended way to install Rust.... M)

But what is bonkers is that pip install can run arbitrary code. The python packaging system is likely to be the next target of such attackers.