Comment by umanwizard

No they haven’t, they’ve been trained to do

    curl https://url-of-well-known-project | sh 

I may not trust the owners of a random domain, but I certainly trust the owners of rustup.rs not to do anything intentionally malicious.