The article mentions that it catches wget | bash as well. I imagine it's due to the fact that bash's characteristic network signature is what they're really detecting, not curl/wget.