I'm assuming the most likely affected Elixir projects would be those using Nerves with SSH enabled and exposed to the public internet, as nerves_ssh wraps the OTP SSH daemon.

Don't think that's a very common thing to do, even in my hobby projects I would only access a Nerves device through a VPN.