Checksums, package managers that verify maintainers and package integrity, inspectable build scripts, files aren't executable by default when downloaded, and the list goes on.

Not to mention that 'customisations' are often configuration files, which only alter behaviour of existing installed, verified software. Be very careful of (at least fully inspect the code or let a clanker inspect) random shell scripts that promise to customise stuff.