I would add that in the beginning, a number of crypto libraries (I'm looking at you in particular, openSSL) made a design decision to support a huge variety of

I would add that in the beginning, a number of crypto libraries (I'm looking at you in particular, openSSL) made a design decision to support a huge variety of algorithms, options, modes of operation etc. This makes it very difficult to test the full functional surface of the software and means you just have to write a very large amount of code. Some of the modern libraries take a different approach where they deliberately limit the functionality to a few select things that can be implemented easily (thinking nacl, libsodium, boringSSL etc here) and which guide the user towards sensible defaults that work rather than having huge numbers of levers to tweak, only some of which arrive at a secure and supported solution.