> Assuming the script is hosted on an https site, is a popular tool (like brew or rustup) from a trusted source, why would this be any more dangerous than downloading and installing from a a package manager?
Most package manager use an offline signature mechanism done at build time (rpm, dpkg, nix) and do not rely on HTTPS security for anything else than eyes-dropping reasons.
Relying purely on HTTPS is insecure. Nothing guarantee you that your source / script / package did not get hacked / modified between the time you uploaded it and the time your user downloaded it.
This is not hypothetical scenario, it already happened in the past with sites like sourceforge.