Sure, any consumer of this API really should fix it themselves to have a secure configuration. But I submit that basically none of them are. An API where almost everyone who uses it wrong is not a good API. When the consequence of using it wrong is poor security, that's a dangerous API.

Knowingly shipping dangerous APIs is irresponsible.

OpenSSL is a god damned shitshow, no questions from me, it's bad, it's dangerous, it's irresponsible.

But they shipped something based on OpenSSL, and now they're making a deliberate decision not to act to protect their users. That's not cool, and that's unacceptable to me. If I actually used Ruby, this would make me reconsider that.