If OpenSSL was for-profit, it would be a corporate project with dozens if not hundreds of developers
It seems like you don't have a very broad exposure to closed source development. Corporations frequently have a skeleton crew working on a component or entire project. You might notice if you get escalated to development enough that it's always like the same guy or two. It's because they might only have a couple of guys working on it. Some companies will spend more on measures to obfuscate that reality than they would spend on actually developing. Certainly some corp closed source projects are that big, but so too are many open source projects.
Hell I've dealt with financial institutions using proprietary software that was abandoned by their vendor 15 years prior (came up because the software no longer worked with new stuff, and the institutions demanded wrapper software for new stuff to imitate the old stuff enough to keep using the unmaintained, unpatched, zero developer project).
I also don't think companies are holding the proprietary vendors to quite the standard you imagine, certainly not automatically. By the same logic you propose for open source "someone else must have done it", you also have that for big companies, if not more so. "Surely they have good security practices" or "it's so popular someone must have done that".