The behaviour of curl depends on how your version was built.

Python? The widely used 'requests' relies on 'certifi' and skips the OS store - but 'pip' on the other hand does use the OS store.

A tool that might use java, like a database or IDE, means it might have its own store.

Node? Make sure you set NODE_USE_SYSTEM_CA=1

Firefox and Chrome AFAIK both have their own stores.

Building a Docker container? That's intentionally isolated from the host, of course your container won't inherit the OS trusted CAs. Running a VM locally? Same.

Installed something using snap? The container-like isolation means it won't pick up the OS trusted CAs.

And of course you need the certs set up right on your cloud servers, your CI servers, the dozen different smartphones the mobile team uses for testing.