Only working memory (the writable part) has to be isolated between users of a shared component. Modern OSes and MMUs do it well. 2 processes using a shared OpenSSL library won't be able to peek at each other. At best, one process may be able to see that the other is using the library by doing some performance analysis, but working data never crosses border (barring a hardware or kernel-level bug).

It is not a problem of data going across process borders, it is about guaranteeing that each dependency is at the version for which the app has been tested with. From a security standpoint, it has pros and cons. The pro is that it is easier to qualify, and it makes the app less susceptible to system-level attacks and regressions. The con is that should a vulnerability be discovered in a dependency, it won't be fixed by a system update, you have to integrate the fix yourself and make a new release.