Downloading things that you don't know about its common for every modern package manager out there, from maven, to nuget, to pip and npm. This is the new norm and there are reasons for it.

I don't think the old C/C++ way of relying on distro package managers would allow for the fast ecosystems people work nowadays.

Things are changing though, and people are pushing for more secure package managers with the same feature set as the old ones, which is possible.

I think this is the missing piece on the first wondering part of your comment. But I don't think we should be bashing the means without understanding the reasons