Curl is so important that if it had a heartbleed and didn’t patch, someone would and people’d just apply it until it was fixed in tree.

Individuals don't but lots of companies do, so that they can threaten to rugpull it later if you don't pay them millions.