I guess you're right, but in this context it's clear by curl's author's blog post mentioned in my original post, that cause can be easily confused by less technically savy readers.
I am interested in knowing which readers are technical enough to know or care what cURL is, but not technical enough to understand that the vulnerability isn’t in cURL itself.
You can know that cURL is some app, she then give it's web pages on the internet.