I suspect this might be because the URL ends up in a shell command line where () makes a subshell. I think some documentation updates would be good here.
This turned out to be a rather interesting case. Internally, FetchContent and ExternalProject implement the download with a foreach() loop over the URLs. Undocumented behavior of that command is causing the parentheses to act as a form of list item boundary (I opened a new issue to cover that undocumented behavior). I think I’ll need to make a small change to the ExternalProject implementation so that it avoids this particular case.