Indeed, and this can be done semi-covertly given that one can detect a "curl install" server-side [1] and serve-up hostile code in just that case

[1] https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...