Curl has had their share of issues with CVEs, I assume they want to show that they are taking actual security issues very seriously. See e.g. https://daniel.haxx.se/blog/2023/08/26/cve-2020-19909-is-eve...

... and that is installed on billions on devices. I can imagine you quickly get very specific conditions here and there when something is deployed at that scale.