According to the CMake documentation, cmake_minimum_required needs to be called before the first call to project() (see notes here: https://cmake.org/cmake/help/latest/command/cmake_minimum_required.html, and at the bottom of this page: https://cmake.org/cmake/help/latest/command/project.html)
This can cause problems if users wish to use CMake functionality like setting their own policy defaults, or if code inside CMake toolchain files (e.g. when cross-building) or using project code injection is used (https://cmake.org/cmake/help/latest/command/project.html#code-injection). Both are useful to set up C++ package managers to provide dependencies.