I think you slipped in the discussion intendations somewhere, this branch of the discussion tree is about the implications of piping curl into bash vs. installing packages

By that logic you have to review the Zed source code as well. Either you trust Zed devs or you don't - decide! If you suspect their install script does something fishy, they could do it just as well as part of the editor. If you run their editor you execute their code, if you run the install script you execute their code - it's the same thing.

Aur is worse because there usually somebody else writes the PKGBUILD, and then you have to either decide whether to trust that person as well, or be confident enough for vetting their work yourself.

Security wise it doesn't matter, you run the code they wrote in any case. So either trust them or don't. Where it matters is making a mess on your computer and possibly leaving cruft behind when uninstalling. But packages are in the works, Arch even has it since before linux support was announced officially.

Additionally, night time is the time of creating backups. A second server pushes its backup also at night too. Potentially long running tasks like database migration I do at night. Lastly, when my server starts up it needs almost an hour until it truly reaches idle (potentially because it has to keep millions of files in sync with syncthing, I have to investigate). So my servers are more busy at night than at day