“Because the server certificate can be validated successfully using the built-in system trust store, we don’t consider this something that needs to be addressed in our platforms.”
You pass curl a specific CA file to say trust only these certificates. Apple’s build quietly falls back to the system store and passes anyway. Stenberg reported it on December 29 and Apple took ten weeks to call it intended behaviour. Every certificate-pinning script on a Mac has been lying to its owner, and Apple is fine with that.