Just remember that brew still must never be installed on a machine you need to be able to trust.

The supply chain security policy of brew is basically non existent and optimized for low-friction contributions. Think wikipedia. No enforced commit signing, review signing, or multi-party release signing, and thus everything is honor system.

Do not put brew anywhere near systems that access production or even on systems used to review production-bound code.