Does that mean that say a security vulnerability in openssl is a responsibility of all software which uses them? I think its unreasonable to expect software projects/products to find things like heartbleed.

What about bugs in kernel/OS? How many user-mode software can find bugs in kernel/OS?