That is a good mindset and you should hold on to it. Of course a gui can install a keylogger for you just as easily if not more so.
Trusted install sources, usually called repositories, are the way. Chances of malware exist, but they would require some spectacular shenanigans or conspiracies to set up.