urllib3 gets installed while installing boto3 and requests, whose dependencies makes up most of the top list
Until you pointed it out I hadn't realised requests had stopped bundling all its deps¹, but that does make me wonder to what extent bundling distorts the usage statistics. For example, packages such as pip bundle over a dozen packages.
¹ According to HISTORY.md this happened in 2.16.0, and that was released in May 2017.