So you can put this on your resume:

Open Source Contributor: - Diagnosed and fixed a key bug on Curl

What if it was some kind of "meta DDoS"? I mean, you can DDoS a server with simple requests, but here the effect is meta: it "DoS"es real humans. What if someone had something to gain from doing this? The tools to do this seem to all be there.

Yes they do. But I also wonder why curl seems to get so many of these. They don't have the highest payouts, have been around for long time so presumably most low hanging fruit the AI has even a remote chance of finding was fixed, and they are well known to be on the lookout and strict about AI reports.