You forgot NPM. Whereby we download code from unknown authors on GitHub and run in with full access to our filesystem on our machines. No vulnerability, it's been designed like this, we even have designed scripts to autoupdate vulnerabilites, that's the proof that vulns are not common.
It's okay, Perl, Python, Go, and Rust do the same thing with their respective package managers.
Well, you certainly should check your Perl knowledge - it's older and do not use Github as a repo :) There is CPAN and testers, etc. Other languages do not invested into that "intemediary" infra.
So "downloading" part is just looking similiar.
Not to worry, Linus said that given enough eyeballs, all bugs are shallow. So it sorts itself out, because we all review the code we download, right?