It's worth zero millions dollars to curl. It might be worth something to attackers, but "wide use" is not the same as "the ability to compromise everyone" because most of the time, curl isn't used to automatically fetch untrusted URLs in a way that's controlled by the attacker from an environment they care about. It's worth much, much less than a 0-day in an iPhone or PHP. You'd need a buyer with a very specific itch to scratch.

By extension, if a vuln is worth something to attackers, it's probably also worth some fraction of it to the people the attackers may go after. But if you're an interesting target, your defense can't be based on the ability to find about every single software defect ahead of the time. You need layers. And if you have that, the importance of proactively acquiring every 0-day is diminished.

Your layers need to be secure too, or you just have colanders stacked together.

A client-side bug in a command line utility that is mostly used as a debugging tool or glue in shell scripts where the URL is not attacker controlled? Probably close to nothing. Maybe if you can find some other software which lets you run curl with an attacker controlled URL, you could package it up as an exploit for that piece of software, but it's not a common config.

Curl is also a library. Just saying :-).

Fair, libcurl is pretty widely used in PHP, but it has to be in the core.

Still way less impactful than the PHP2Shell issue.

libcurl is used in a lot more than PHP. libcurl is installed on more than 20 billion devices.

... 50% of which probably never get connected to the internet, and 50% of the remainder probably only connect to one hardcoded domain name.