Maybe they have other things to do?

Seems like everyone who relies on OpenSSL as a critical part of their infrastructure has "other things to do", and then is indignant when new vulnerabilities come along.

The tragedy of the commons, yes. The solution isn't to ask a random possibly unaffected individual why they didn't fix it.