Yeah, we actively encourage authors / maintainers to NOT publish the direct URLs and to instead install everything via Community Applications. Then there are controls in place to ensure that you only wind up installing stuff that's compatible, works (bugs aside), and is secure.