the chain of trust is solid up until make and configure happen, at that point any number of things could happen so it's a question of whether or not you trust whatever scripts its running.

unless homebrew has some sort of enforcement on what that script can do it could do anything. This is why its a really good thing that homebrew does not require root.