So do the pre- and post-install scripts of Debian packages. The problem is not this but the lack of verified and controlled release channel.