Why do Ansible modules that run arbitrary commands need special care?

Modules like command and shell just run what you give them; Ansible can't know whether the command already took effect, so they aren't idempotent unless you make them so.

A module like ansible.builtin.package checks the current state before acting. A module like ansible.builtin.command or ansible.builtin.shell simply executes a command line, and it reports "changed" every time, even if the command did nothing new.

To use them safely:

• prefer a dedicated module if one exists (copy, user, service, lineinfile, …);
• otherwise tell Ansible how to tell whether the work is done, e.g. creates: /opt/app/installed.flag (skip if that file exists) or changed_when: with a condition on the output.

- name: Run the installer only once
  ansible.builtin.command: /opt/app/install.sh
  args:
    creates: /opt/app/installed.flag

Go deeper:

• ansible.builtin.command module (official docs) — the creates / removes parameters and when to use a different module.
• Error handling in playbooks (official docs) — changed_when and failed_when for making command tasks report the truth.