What makes this a bit more understandable is: almost nothing uses libssh server functionality. So most development was only focused on client functionality.

(The only notable exception, github.com backends, were not using the auth logic code in question, so again just not used and not given attention...)