I rate curl | * as low on the vulnerability scale; scale, as in compared to so many other forms of control we grant regularly to unreviewed code. Yeah, it's not

I rate curl | * as low on the vulnerability scale; scale, as in compared to so many other forms of control we grant regularly to unreviewed code. Yeah, it's not great in practice to do this without reviewing the source, but how often do you "pip install" or "npm install" without reading all 1000 lines of code, plus 1000 lines for each required dependency? How often do you compare hashes (if even available" for binary images? I think in the modern state of software, most verification is done via reputation and critical assessment, vs technical review as in times past.