As I see it, this all doesn't matter though as soon as "security update" enters the picture. The problem here is upstream dev's saying "my dependency needs are

As I see it, this all doesn't matter though as soon as "security update" enters the picture. The problem here is upstream dev's saying "my dependency needs are absolute". And a security update ruins that: because as soon as one happens, now no matter what we're going to be replacing libraries anyway. Even your prosposal includes this: we're going to strip out openssl librares and use distro ones. At which point everything might break anyway, because whether a security hole can be fixed at all depends on which versions of a library it affects and how. Not to mention problem's like finding the issue in one version, but it's changed enough that it's not clear whether a different version is impacted the same way.