You would thing a distro like this would be more like gentoo...you recompile stuff as needed (which for openssl means almost everything).
With static linking, you literally need to recompile everything that uses the library in any form, for every single change. So of there's a security fix in openssl and LibreOffice uses openssl, you need to recompile LibreOffice. If QEMU uses libssh2 which uses openssl, you need to recompile QEMU, even though it doesn't use openssl directly. With Gentoo you just recompile openssl and that's it.
And if there a fix to glibc, you need to recompile EVERYTHING because everything would be statically linked to it.