Yes, I absolutely do know people who do this. I know people who accidentally let a GPG key expire and spent some long nights figuring out a way to get the thing trusted again so they could sign .debs, because dammit, THEY sign the .debs not some maintainer somewhere else. I know people who run their own deb mirrors (this is really common! I know SHITLOADS of people with Debian mirrors!). I know people who do everything from control servers that have a minimal set of software, people who run new software in locked down testing servers before wider release. And I know people who are Debian maintainers who actually do review the code that gets built, even if it's not a line-by-line audit. I know people who compile from source and compare executable checksums to see if it matches the official repo, ever since reproducible builds is a thing.
Some of these people are crazy because they're paid to be crazy by a software firm. Some of these people are too crazy for the software firms, they work as consultants and in their free time they're constantly trying to get firmware dumps of their game consoles, phones, and laptops.
And yes, a bunch of these people are on your side. But if you curl | sh it's harder for anyone to help you, including yourself, when shit goes south.
> Someone actually reviewing the source code is in a different category entirely, they don't need a download at all.
This isn't an all-or-nothing deal. Just because you read the source code for a package doesn't mean that you can't also download the binary. Reproducible builds give you some additional confidence that something weird hasn't been snuck in through a single compromised machine, and additional confidence that the binary package corresponds to the source code even if you didn't personally build it.
Malicious software is also not the only thing you're looking for, but things like unsafe practices in the code or insecure defaults.
In practice I do review source code from time to time before I install something, and sometimes I decide not to install it after looking at the source.
It's an edge case at best. If that's the best argument not to curl, there are no good arguments.
I'm in favor of things that noticably help the risk of spear phishing, but are you sure this does?