Curl has had their share of issues with CVEs, I assume they want to show that they are taking actual security issues very seriously. See e.g. https://daniel.haxx.se/blog/2023/08/26/cve-2020-19909-is-eve...