While cryptographically it's the right move (everything below TLS 1.2 with an AEAD is cryptographically broken), this disables connectivity with half of the Internet. There is a huge number of hosts out there running on legacy hardware that won't do anything beyond TLS 1.0.
That's not how the Debian release process works. If everything goes well, that package may hit testing next week[0]; and it may very well be that the next stable release will be in two years.
Packages are not promoted into (out of?) testing unless they don't have open issues reported against them. If this concerns you, then the right thing to do is to file an issue. Keep it open long enough and this won't make it into the next stable release.
If necessary, someone will create a dotdeb-equivalent for an openssl version with TLS 1.0. This is a "dammed if you do, dammed if you don't" type of thing. If they don't disable it, at the next big security issue, everyone will blame openssl/distributions for being negligent.
The other way to look at it is that you have security vulnerabilities because a portion of the internet is stuck in a decade old obsolete world.
EDIT: Seems the last version of Android 4 does support TLS 1.2, but there's still a non-zero amount of users on older versions.