But if you look at the code, you might come to the conclusion that the upstream is not so focused code quality (security!) as one might hope. There is such a jungle of code that can only be justified by the desire for more features, more portability (to crazy ancient platforms too), more speed, more flexibility... it's all more knobs and code where real security bugs can lurk. And code paths that do not get tested properly. You can also find many outright dangerous idioms used throughout. Does that mean the upstream is ignorant, or that they do not care, or that they do not have the man power to fix their aging code? Either way, it's bad.
The OpenBSD developers have different priorities, and they believe they can do better. As such, not being able to blindly pull changes and updates from the upstream developers they do not trust does not look like a significant loss. If new features are to be merged in, it has to be properly reviewed and adapted. Yes, it's more work that way. But the end result is likely better code.