That was 2025. This year he has stated that there get many AI reports per day and nearly all are real issues. Things have changed a lot in the past few months.
Though CURL didn't restart their bug bounty program so there is no inventive to submit slop anymore.