Have other Apple-supplied HTTPS client components also been checked for this sneaky wire-tapping enablement?
Nevertheless, this only needs to combine with a hidden shim proxy to enable man-in-the-middle attacks, with susceptibility to wire fraud and content tampering.
Also, does the Mac manpage for curl disclose this modified effect of -cacert? If not, then the software is being fraudulently misrepresented.
And on a whole different note, is it possible Apple received a National Security Letter (NSL) compelling them to make this sneaky modification, to enable Federal eavesdropping? Notably, Apple long ago stopped maintaining their warrant canary.