Have there been any notable incidents where mistrusting a curl | sh was the cause? I hear people say not to do it way more than I hear people talking about actual incidents it's caused.

Not as bad as giving it your root password which it asks on step 3. Not via sudo or run0, it asks you a password which it saves so it can then use sudo or run0. Uuuh no.