Op did immediately above you i.e.: "nothing to do with malice or exploitability"

and when asked to explain you responded with: "Didn't they say it already?"

Which any reader can verify they have not at the time of 1:42pm EST Oct 23 2026.

There are two different things here: there’s code that is vulnerable because of unnecessary complexity, and there is imputing malice or an intent to hide exploitability through complexity. OpenSSL exhibits the former, not the latter.