curl currently looks on Linux and othe unixes at the file ~/.curlrc for its default --config file. Clutter directly in $HOME is considered by many users to be undesirable. It makes it hard to distinguish between documents, configuration, and caches, complicates e.g. "dotfiles" repositories, and makes it hard to nuke cache data that can be safely deleted at the cost of making the program work to recreate it.

Some history on dotfiles as a Unix feature seems appropriate: https://web.archive.org/web/20190320095434/https://plus.google.com/+RobPikeTheHuman/posts/R58WgWwN9jp

Windows solves this by using %APPDATA% (and curl respects that). Linux established the XDG Base Directory Specification for this:

https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html
https://ploum.net/207-modify-your-application-to-use-xdg-folders/

tl;dr

$XDG_CONFIG_HOME is the preferred location for config data. $XDG_CACHE_HOME is not relevant to curl, I believe.

Use ${XDG_CONFIG_HOME:-$HOME/.config}/curlrc, if the user created it.
(If the variable does not exist, it is assumed to be $HOME/.config.)

For backwards compat, if the above does not exist but the previous location ~/.curlrc does exist, use that.
For backwards compat, if $CURL_HOME exists it should probably override $XDG_CONFIG_HOME.

curl also respects ~/.netrc which could be similarly looked up in $XDG_CONFIG_HOME, but I'm not sure how much of a point there is for that, given it itself is intended for compat with other ftp tools.

curl/libcurl version

curl 7.71.1 (x86_64-pc-linux-gnu) libcurl/7.71.1 OpenSSL/1.1.1g zlib/1.2.11 libidn2/2.3.0 libpsl/0.21.0 (+libidn2/2.2.0) libssh2/1.9.0 nghttp2/1.41.0
Release-Date: 2020-07-01
Protocols: dict file ftp ftps gopher http https imap imaps pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp 
Features: AsynchDNS GSS-API HTTP2 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM NTLM_WB PSL SPNEGO SSL TLS-SRP UnixSockets

operating system

Linux x86_64