The forks might not be quite so full of holes.
The LibReSSL folks removed the whole SRP module from their tree recently[0] because an embargo that prevented them from releasing just a bugfix in what they thought was a reasonable timeframe. I'm guessing that was for either CVE-2014-5139 or CVE-2014-3512.
That does actually give me some confidence that some of the other non-OpenSSL dev teams might do measurably better.