Not sure this statements holds in this general form - it's a very good idea to be cautious what you execute, but curl | sh is not much different from running npx for example. It's difficult to know know what will actually be executed on your machine, but at least shell scripts can be inspected/audited (as compared to packages with 100 dependencies).
That said, prior to piping anything to a shell it's advisable to inspect what is about to be executed. That's why the lama.sh script is super simple, as is the code of the web server it downloads and executes.
