How was this bug found again? Oh yeah. By analyzing the _open_ source code.

It was found by fuzzing. OpenSSL being open has absolutely nothing to do with its security, in a positive or negative way. It's just a poor project.