I forgot but do browsers download binaries as executable?

One of the big issues with windows is the fact that it uses file extensions for determining file type, so EXEs can just be instantly run after downloading, which led to MSFT making the "Mark Of Th Web" attribute, which moved hackers into finding every type of bypass for MOTW.

I think straight bin downloads require you to chmod +x first, but you could also probably bypass it with any archive format like .tar.gz or opting for a .deb or .rpm.

The upside is that you really shouldn't be downloading raw bins outside of the package manager, but there are a bunch of tools that only ship as appimages, so you're kinda screwed if you download and execute from an untrusted source.