Homebrew, rbenv, rvm, to name a few. Never understood it either. If you could get ahold of a domain write a malicious script at /some-script.sh, you could do a lot of damage.

I agree that it feels insecure, but is there really a difference between this and downloading and running files from a .tar.gz or installing a .deb for example?

Yes.

apt-get:

  $ ls -l /etc/apt/trusted.gpg.d/

Source Installation:

  $ wget http://nmap.org/dist/sigs/nmap-6.01.tgz.asc
  $ wget http://nmap.org/dist/nmap-6.01.tgz
  $ gpg nmap-6.01.tgz.asc

This is an important part of why Debian and its derivatives are superior to OS X for web development. If you like Mac hardware like I do, at least run a Linux distro as a virtual machine and save yourself the trouble of Homebrew or its contemporaries.

The point is that most people don't do this.

Its built into apt. Unless you are suggesting that most people do:

  # apt-get --allow-unauthenticated ...

debs are authenticated.

With a .tar.gz you can verify a checksum.

Would adding a hash check for some-script.sh solve the security issue?

A published hash sum on its own only protects against non-malicious errors in the download. This is of limited use, since even regular HTTP is verified with a 16 bit CRC checksum.

Distributing a hash check over HTTPS would offer some protection against man in the middle style attacks, to the extent that TLS protects against man in the middle attacks, but accomplishes nothing if the server has been compromised.

Distributing a signature of the download gives stronger protection, because the private key can be kept offline and encrypted except when in use. Breaking into a server and overwriting a few files is easier than breaking into someone's laptop in the brief moment where they unlock their keypair to sign a release.

I don't know if it did so in the past, but it doesn't currently.