Comment by Un1corn

Pastejacking is not the only possible attack by a compromised server, you can also change the content of the script when the user download it through curl or wget.

Oh My Zsh use GitHub for their script so I trust it more than if they hosted it themselves for example