I get why there are people that don’t like how some installers do this, but this trope is really turning into the “but I don’t even own a TV” of OSS commentary.
Just use the Docker image if you don’t like it. Or get their appliance which actually supports ongoing development.
I periodically get told that a published browser userscript of mine is malicious or suspicious in emails simply because of the cautions and wording around the userscript installers themselves (it's just a css tweak, a theme), meanwhile the executables I have in the wild have generated zero similar feedback.
my theory is that since the script is more easily read that it attracts people to read it without any theory or knowledge of what they're even looking at .
Where something that can be verified gets more scrutiny than something that can’t.
Maybe someone else knows.