@zaarn explained in another comment that the vulnerability did not impact him, he did not exercise that code path.
I understand that, but it's not really relevant.
The code path that failed to build was still related to the included crypto (even if it was due to compiler change).
If that was their only way to fix the crypto issue, then it's totally fine, because that way they fixed it for people who did need and exercize the crypto code path -- and those take priority over people who "bundled some crypto code but didn't exercize that code path and their build still broke".
I exercized a code path that broke, it's not like unrelated code broke, it was code I was actually using in a commit in the upstream library that changed not much for the end user and then was broken by the compiler fairly soon after.
The issue is related to AVX detection in the CPU, which has the reasonable failure path of "don't build it with AVX".
If you use vulnerable crypto (willing to go with old unpatched vendored code) then you don't really need crypto at all..