> It great that OpenSSL have improved quality, yet it feels like they're rewarded for cleaning up their own mess.

Though to be honest, an insane amount of stuff relies on OpenSSH for their security, and has for years. If their code was messy earlier, ok, but they have still been basically de facto standard SSH client for much of networking. I'd say their prize is well earned.