Comment by EGreg

Composer isn't one file, and doesn't use zip format, or signed hashes as far as I know. The sources could be compromised, for instance. And it couldn't be 'simply installed' by an average joe