The code in the module isn’t arbitrary: it’s what the user intended an install, provided the package hasn’t been compromised. I do see your own version though.

Most apps don’t need install scripts so disabling them by default is fine.