Well, they take on responsibility as stewards, which means they will be the target of criticisms and backdoor attempts, and will need to meet the demands of downstream demand for fixes, requests and help. They also need to (have already) spend time on understanding the code, development and integration. They need to communicate the problems with OpenSSL and what they've done to other people within the ecosystem.