Legacy. You rarely only touch new stuff or secure stuff. And instead end up at least with one scenario that requires you do something with old stuff. And this is not just crypto.
They should have another library which, like I said, actively deprecates obsolete and insecure practices but in a way that makes the update process digestible for people depending on it.
Both problems are from the lack of knowledge, but latter one is orders of magnitude harder to fix.
OpenSSL isn't a recommendation for developers. For TLS, LibreSSL and BoringSSL are. For other stuff, libsodium is.
The only reason I've picked OpenSSL, is it has a higher level library (pyca/cryptography) that gives bindings to X448.