Comment by okasaki

In Linux distributions you get it from the distribution repository, and automatic updates are disabled. So at least it's reviewed by a third party.