> I presume they mean nginx will be the default web server, rather than removing Apache altogether?

It says "to provide an apache replacement for base." OpenBSD has a Base system, plus it has Packages and Ports. Packages and Ports do not go through the same security audit as the Base system. Currently the version of httpd in Base is 1.3.x, which is all patched and secure, Packages/Ports has httpd 2.2.x. I suspect they mean nginx will replace httpd in the Base system, while httpd will still be in Packages/Ports.