Although I condemn Al Nocai's method, I feel for him and I am inclined to adopt the contrarian opinion that he probably got screwed because of the bad quality of curl.
Curl had some remote exploit last year, and curl is used everywhere as the author reminds (often as libcurl). https://daniel.haxx.se/blog/2020/02/03/remote-exploiting-cur...
The deeper underlying systemic problem is that open-source is a way to disclaim all responsibilities. When some open-source project has some level of reach there needs to be quality requirements and regular security audits. (like they (last?) did in 2016, https://daniel.haxx.se/blog/2016/11/23/curl-security-audit/)
Otherwise it's like the OpenSSL's heartbleed story where a few unpaid project maintainers hold the keys to the world.
In today's interdependent world, when trying to build something, we are more and more reliant on the quality of the library we use. As a product builder facing the client you get to bear the responsibility when your client has a problem because of a library you use. But when open-source software removed the possibility of competing solutions by providing free "as is" software, you can't realistically chose not to use it, and you are the one left holding the bag and paying the price for others mistakes.