curl is the sandbox. It exchanges packets with the internet and then outputs a safely sanitized byte stream.
replycurl is only the sandbox if you don't then do anything with the byte stream.
replyPipe it to bash? game over
Pipe it to less/more? Better hope your distro keeps those patched
Open the file in a browser or PDF reader? Hey, look at all this shiny new attack surface!