NetBSD 8.0 took longer to release than intended.

The comparison to "oldest clang/gcc you can get in a linux distro" is not right, you can get a lot of different versions as packages. this refers to the base compiler which is used to build everything. GCC 8.1 is available as a package for example.

As for the base GCC versions, NetBSD is a little conservative when updating, but keep in mind that it's doing this on a lot of architectures and problems arise. a complete transition to GCC 5.x was held back somewhat by a tricky mipseb-softfloat bug, GCC 6.x (in -current) was held back by a VAX ICE. Newer GCC kills ARMv4-nonthumb support.

If that is OpenSSL 1.0.2k it probably should be updated, yeah.