I agree with you, now for completeness I should mention that Linux package formats usually allow packagers to provide arbitrary pre- and post- install shell scripts ran as root.
(which means that if you don't trust a provider, not only it's not safe to run the program, but it's also unsafe to install it)
(which means that if you don't trust a provider, not only it's not safe to run the program, but it's also unsafe to install it)