That statement is certainly true.

But how do you think you install software on Windows? You download a random installer from the internet and double-click it. The installer is an executable file and runs some code on your computer to set up the software. I’d argue it’s exactly the same.

In the one instance you copy and paste code and run it. In the other instance you execute an installer that also contains the random code. And you can’t even have a look what happens.

The real issue is: You have to trust the vendor. If you don’t trust Mullvad, don’t run their 5 lines of code. But you then also shouldn’t install their software and not run their windows installer. I don’t see a way around this ‘trust’ issue.

The proper way of course would be a standardised process that also confines the software into containers with minimal permissions. Something like Android Apps. In theory you could add a default update process so the vendor just needs to define an update server in the (apk) installer file. Google didn’t do this, but they want people to use their Play Store. And I don’t think we have a permission system that is actively used on any of the major desktop operating systems, anyways.