With a downloaded file your antivirus will run automated checks on it, you can calculate a hash signature and compare the value with others who also download the file, and you will notice if the file changes after you execute it.

If you download it first, you can at least eyeball what's been downloaded to check it doesn't start by installing a bitcoin miner

How often do people do that when they install a package from npm, pypi, or other package repository? In practice never.