I think this problem is similar to the OpenSSL problem. The idea being that we have a library that has a giant attack surface because it does a LOT of different

I think this problem is similar to the OpenSSL problem. The idea being that we have a library that has a giant attack surface because it does a LOT of different things and attackers find clever ways to abuse those extra features that most users don't actually want enabled. Your car probably wants to use some relatively pedestrian things like HTTPS, but do you think it should have any capability of doing GOPHER, SMBS, SFTP, POP3, LDAP, IMAP, TELNET, TFTP, SCP or any of the other stuff curl supports out of the box? We can hope that the version of curl used for the car was compiled without support for some of these protocols. I don't even know if we have a good way to verify that. More likely is that whatever the stock configuration (all the protocols) is what is being used in most applications.