I think we need to reconsider the definition of a "vetted library". It's only because I spend a lot of time in this space I'm aware of at least three different libraries that default to unauthenticated CBC mode, and choose key sizes magically based on input (hint: it never ends up what people expect).

But those libraries show up recommended on forums and subreddits everywhere. And if you inherit such a system and try to do something like "add an HMAC", you'll be cursed at for "rolling your own crypto" when you should apparently be trusting the library.