I think it makes sense to leave freeing up to the callback, because then management of the object (whatever it is) is up to the caller rather than the library. It might make sense to reuse it for a subsequent request (one way or another), or have it as part of some larger object, or some other thing - etc.

As for using the stdlib heap rather than some other thing: sure. But the routine allocating the buffer in this case used malloc to allocate it, and therefore freeing it with free seems at least not the worst option. If you want to do some other thing, you should do that instead.