My way of defending, partially: installing the free software on to a virtual machine, then take the extracted files and see if they work (mostly yes) on to the host machine or another virtual machine, and if they try to sneak in stuff. It is a pain when the program tries for updates later, but not too much.
I wish the OS was built in such a way that the program will reach resources only to basic show itself and basic folder permissions, without needing registry entries, files present in special system folders, startup entries and whatnot. That way, even if a bundle installs 2 programs, I can just delete the other program (simple delete), and if the other program is somehow 'needed', maybe I will re-evaluate if I need the original program in the first place.