In the case of cURL, there's a much greater amount of network exposure. It would be extremely irresponsible for Apple to simply ship an older version missing security patches.