New curl is out

New curl release, various CVE fixes.
just a question, why BY DEFAULT if I run cmake .. and ccmake . I get
BUNDLED_CURL ON                                                                                        
BUNDLED_LIBNET ON                                                                                      
BUNDLED_LIBS ON        
and                                                                                     
SYSTEM_CURL ON                                                                  
SYSTEM_LIBNET ON                                                                    
SYSTEM_LIBS ON


shouldn't be them mutually exclusive? (at least by default)