It's auditable, just redirect, don't pipe. Or fix your bash to not allow this.
It has nothing to do with XAI, other than maybe not enforcing good practice (which most devs don't follow anyway).
Or they are sending different code to different people from the same url…
Or they are sending different code to different people from the same url…