Looking at the long history of openbsd and some similar projects, I think being rude like that is what you do when you're too far on to the spectrum to effectively articulate an argument. It probably has something to do with lack of empathy as well... There are very real reasons why their project and user base is the size it is.
No, being direct is what you do if it's important. I agree that the above quotes aren't polite, but I don't think they're terribly rude. If I publish half-assed code that is hopelessly structured (even if there are reasons for it; "There's too much old cruft", "I don't have time to ...") -- I wouldn't mind getting called on my bullshit. If you suck, and someone point out to you, that you do, in fact suck -- then you should thank that someone.
Sure, it might be nicer if they're polite about it -- but it's really not that big of a deal.
But those who follow the commits know that the developers like to express their minds in the commit messages whether it is bad code written by one of them or somebody else. They're not targetting and publicly shaming some project while throwing insults straight at developers.
It might be "unprofessional" which is to say, it's not polite (and since they're giving it away - why would it be "professional" -- they're not (necessarily) getting paid for the work) -- but it's not really disproportionately hostile, and most of all, I disagree that it's "unnecessary".
As evidenced in part by recent security issues, and in part by what the libressl project has dug up/cut away: the code base was horrid for the purpose (providing authentication and confidentiality). Much worse than merely "not good".
I think the (rightfully) hostile attitude helps others realize just how bad things were/are. And I welcome it. I'm sure a few developers are hurt by the comments, but all of your quotes above are pretty much factual and concrete: it's not name calling for the sake of being rude; it's a wake-up call. I'd be surprised if not a few "victims" of those comments aren't also glad that errors are both found and pointed out. Just as if you hacked together a not-quite working break system for a car, you'd prefer being called out as a hack, and someone fixing it, rather than having lots of people get hurt. The stakes involving openssl can actually be life or death.