Here I am worrying about supply chain risks and duckdb is installing binaries from duckdb.org at runtime.
Fortunately, duckdb.org is so wealthy they will never go out of business and have their domain highjacked by malicious users who would replace those binaries with something else.