If I don't trust the website to do curl | sudo bash then why do I trust the software that I would eventually install?
Even the old argument of "middleware devices modified the script en-route" is mostly removed by HTTPS everywhere.
And there are people like you who actually look at the script (and the compiled code, too!) to find things, because if they do find something in a script as big as HomeAssitant, they'll be famous.