It could simply be my lack of in-depth understading of curl, but wouldn't curl make for a pretty weird target for a backdoor? It doesn't serve content or remain running for long periods of time, does it?
No it doesn't, but what if you can be convinced to use a compromised version of curl that downloads a compromised nginx? This is the threat model that we are looking at here. That's why we should always verify signatures for packages we download, to make sure we get the right bits.
But it's used a lot and makes network connections. If it had a remote-code-execution vulnerability in how it handled connections, then it could provide an easy path for man-in-the-middle attackers to get into systems.