The majority of those applications and devices are already stuck on 0.9.x anyway, so it's not like it makes that much of a difference. It doesn't seem like tha

The majority of those applications and devices are already stuck on 0.9.x anyway, so it's not like it makes that much of a difference. It doesn't seem like that big of a deal to me. The majority of "shitty IOT devices" only make outgoing TLS connections to relatively trusted external servers (i.e. the company's server), and it's hard enough to MITM connections at scale that you're probably fine. Just don't let a malicious stranger on your wifi. Adding to that, it's also pretty hard to develop real exploits for the supposed RCE CVEs that you see. Like, most of them are "there's a buffer overrun, this is probably RCE", but most of the time it's actually "no, for all real builds of openssl, this is a crash and that is it".