The latest OpenSSL vulns were added fairly recently
If I recall, back when HeartBleed hit, the OpenSSL Project only had 1 FTE worth of paid developers & managers working on their code.<p>Wikipedia claims that (<i>as of 2019</i>) they have 2 FTE's worth, plus a dozen or so volunteers...who are a big overlap with their management committee.  And their total budget is < $1M/year.<p>Not to suggest that volunteer coders are automatically lesser coders...but for widely-used, uber-critical, uber-complex code, that sounds pretty profoundly under-resourced.<p>Edit:  Adding the full quote from Wikipedia:  "As of May 2019,[7] the OpenSSL management committee consisted of 7 people[8] and there are 17 developers[9] with commit access (many of whom are also part of the OpenSSL management committee). There are only two full-time employees (fellows) and the remainder are volunteers."