> OpenSSL exhibits the former, not the latter.

The OpenBSD folks came to the exact opposite conclusion after auditing the code:

"In a nutshell, This was a very effective exploit mitigation technique countermeasure. It could not have been designed better to make an attack like heartbleed both hard to detect and have dire consequences. OpenBSD's memory allocator, Valgrind, and Coverity do not notice the memory issues."

https://www.openbsd.org/papers/bsdcan14-libressl/mgp00007.ht...

Just a single damning slide among many here: https://www.openbsd.org/papers/bsdcan14-libressl/

More here: https://www.libressl.org/papers.html

Further, known exploits like the one crafted for XZ take advantage of plausible deniability and trust in contributors at every opportunity. Meaning that even if you wanted to disclaim malice, you cannot do so effectively.