The author didn't ignore this, because it's pretty much false. Every package people insisted was relevant, he shot down before he published the article. Example:
https://cmpwn.com/@sir/104406644780241359
Hitchen's razor.
This must not be counting packages which depend on openssl by a chain of dependencies, some number of which contain binaries or libraries which link libssl. On my desktop Arch system of 1448 packages, 42 depend directly on openssl and 672 depend on it directly or indirectly. (pactree -ur openssl | wc -l, then subtract one for openssl itself)