The issue is not the package manager being hijacked but the package. And the package is often outside the "major distribution" repository. That's why you use curl | bash in the first place.

Your question does not apply to the case discussed at all, and if we modify it to apply, the answer does not argue your point at all.