Your beef is with ulf@openssl.org, not the Debian project.
There's a limit to how much effort the OpenSSL developers should have to put into stopping people from shooting themselves in the foot, and tracking down lines of code identified only by their line number in an unspecified version of OpenSSL to make sure they do what some random guy on the mailing list thinks they do is way over that limit.
Are you comparing the Synology GNU/Linux distro to Debian or some generic [non-Debian] distro to Debian?
If you are comparing Synology to Debian, then the "trusted" source argument is entirely flawed. The source, meaning both source code and source of software, of software running on Synology hardware is not Synology. Synology only makes the GUI client that runs on your machine that locally interfaces to the NAS box.
As to the Debian 2006 SSL problem... stuff happens... Apple had some silly security problems too, much more recently than 2006. And Android is so full of holes, it's a wonder the platform works at all...
However, when the generalized public buys a NAS product -- the vendor should indicate the potential security problems regarding "cloud" connections in big bold letters on the box and in the manual and have a large red warning that pops up in the user interface. My guess is most users wouldn't care, but it actually is extremely risky to connect these devices to the wild wild west open Internet.