EVP lets you shoot yourself in the foot in various ways. OpenSSL also doesn't provide any API to e.g. validate a TLS cert chain, so everyone does it their own way and often gets it wrong.