> The code footprint is small, the surface area for vulnerabilities is small.

I disagree. Their NIH-syndrome and ancient practices seem to be a constant source of new CVE:s [1].

1: https://curl.se/docs/security.html