For HTTPS to truly be meaningful we need to stop supporting HTTP as an on-ramp, to prevent people from just hijacking that initial unencrypted connection and sending anything they want.
I truly do not care if someone goes through the effort to MITM my curl of ec2.shop to inject fake prices or something like that.
There's nothing here that's going to be executed, it'll just be printed or grepped.
In theory you could exploit a 0 day in curl or my terminal or something like that, but I think if you truly think about the risks and tradeoffs here it's really not worth worrying about.
If curl had an hsts list to make this irrelevant that'd also be cool.
... yet.
Imagine someone using it to find "the biggest size available under $1" and then taking that value to execute some other script.