It is, but please note that OpenSSH uses very little of OpenSSL's code. None of the serious bugs lately had any impact on OpenSSH.

That's probably very reassuring.

I personally don't share this belief that openssl is bad (in fact, for PHP developers, openssl is preferable to libmcrypt which has been abandoned since 2007), I just know it's a common sentiment of infosec people. :)

Just because OpenSSL is very hard to replace doesn't mean it's not very bad.

Sure. I simply use it for crypto primitives (e.g. aes-256-gcm) in environments where I cannot install libsodium from PECL (e.g. crypto_easybox() and crypto_easybox_open()).

It is also useful for embedded devices with small flash/ROM.

What functionality do you lose if you build it with that option?

From the article:

    Disables and removes dependency on OpenSSL. Many features,
    including SSH protocol 1 are not supported and the set of crypto
    options is greatly restricted. This will only work on systems
    with native arc4random or /dev/urandom.

I haven't dug into the source code, but I'd wager that the crypto options that remain are Ed25519, ChaCha20-Poly1305, etc. (Don't quote me on this, however.)

So if I (like most people with modern systems) only use SSH2 + AES, I should be OK?

Have you switched everything to Ed25519 keys?