Sure the startup culture and new breed (new bubble?) tech companies mostly emphasise it, but among older companies it's much less common for a few reasons:
1. It just wasn't considered normal practice until fairly recently. 2. They often use 'lower level' languages, and as @raverbashing mentions, they're more difficult to test. 3. The companies are much slower moving, so arguably have less of a risk with not having automated testing. Automated testing has more benefits in agile than it does in the waterfall methodology.
The bug happens very deep inside the handshake protocol and it's extremely hard to test it automatically.
If the code doesn't belong there, get rid of it. If, for whatever reason, you want to show the reader that code used to be there, delete it and leave an explanatory comment. If you're commenting it out because you're not confident in taking it out or you plan to re-enable it in the future, well, that's what you have source control for.
And sometimes impossible
In Python/Ruby sure, it's easy. In Java, or even C++, it's doable, but not great, and it requires some heavy tricks.
But they surely need tests, but not necessarily TDD.
This is what I expect from an OS developers
Maybe the people from OpenSSL have some test like that already
I've been in that position. Sometimes with embedded, you can't have software fixtures, only hardware ones. (Bit banging)
And you think you know what the device answers and understands, but there's usually some gotchas.