True, and by that same logic maybe anyone using ruby's TLS client shouldn't ship anything if they aren't prepared to take responsibility for how it's configured (since the default configuration can be overridden at any point from OpenSSL on up).
Knowingly shipping dangerous APIs is irresponsible.
OpenSSL is a god damned shitshow, no questions from me, it's bad, it's dangerous, it's irresponsible.
But they shipped something based on OpenSSL, and now they're making a deliberate decision not to act to protect their users. That's not cool, and that's unacceptable to me. If I actually used Ruby, this would make me reconsider that.
However the fact that other people should also be claiming responsibility for their own security does not absolve ruby of it's own responsibilities.