Apple for the longest time shipped OpenSSL as a library that developers could link against in their binaries. Unfortunately OpenSSL even in minor versions could and would change function calls thereby making it almost impossible to keep up to date with OpenSSL for dynamic libraries because each new version required the developer to recompile the binary.

Apple thus stopped shipping OpenSSL and has officially deprecated it, these days you won't find headers for it anywhere in the stock system and there is no official way to link against it anymore either in El Capitan. It just exists for backwards compatibility.

If a developer now wants to use OpenSSL in their binary instead of the Common Crypto framework that Apple provides they will have to provide their own version of the library in their application, and they are then responsible for making sure users get patched in time.

Developers link against system OpenSSL, so Apple can basically never upgrade it.