Running apt install ffmpeg feels like one clean action. It is not. A package can run maintainer scripts as root, rewrite the dpkg database, drop config into /etc, and pull dependencies that do the same. Installing one tool means handing root to code nobody read. A short story about why install is a bigger decision than it looks.