Who should write crypto code? People with PhDs in Cryptography and deep experience with the language they are using!
What does OpenSSL do? Not that!
If this was measured like a startup they have been wildly successful by ignoring best practices and offering something that people want and that works just good enough.
I'm honestly shocked more critical bugs haven't been found in it. I guess that attests to the power of tools like Valgrind