There's a pretty big difference between a random report submitted via email, and, say, a close friend of the maintainers letting them know a serious vuln was found and they should login.
Not if it's a real vacation. If it was me then there would be no way I'd log in. Maybe this will increase the sales of support contracts.
Curl maintainers are clearly going to still be using computers to provide support for paid customers.
But the message is pretty clear: if you’re not a paid customer, you are not getting patches or support from upstream during this month.
Plan accordingly.