I'm not personally familiar with any commercial products shipping OpenBSD, but it was my understanding that the "proper" way to do this is to fork the OpenBSD build infrastructure, or at least build your own release tarballs, and basically push your own OpenBSD'ish distro. AFAIU, the binary patching and upgrade frameworks make some (limited?) effort to accommodate the creation and maintenance of bespoke releases.

But maybe doing it the "proper" way is too difficult or opaque, incentivizing vendors (even more than they usually are) to simply abandon released models.