You're not downloading from github, but from dl.jitpass.com.
And an executable can do exactly the same as a shell script. The point is that whatever you're executing isn't verified, whether it's a shell script or a binary.
The difference is you have the executable for examination (at least a quick virus scan) before you run it. Certanly not perfect, but what is?
> The point is that whatever you're executing isn't verified, whether it's a shell script or a binary.
The GP said:
> This should be an ordinary app bundle to drop into /Applications
There is no difference between downloading an app bundle that you drop into /Applications, and curling a binary that you put in /usr/local/bin/