The BoringSSL project publishes side-by-side analysis of OpenSSL advisories describing how they do/don't apply to BoringSSL. They're usually quite interesting.

Here's the latest one for the Jan 27th batch of CVEs: https://boringssl.googlesource.com/boringssl/+/refs/heads/main/docs/advisories/2026-01-27.md

The PyCA folks have recently enumerated many issues with the OpenSSL project's engineering culture (see https://cryptography.io/en/latest/statements/state-of-openssl/) but it also comes through clearly in this table full of "issue was introduced after fork".

As a thought experiment, if we waved a magic wand and replaced all of the OpenSSL C code with Rust but left everything else the same, would we get better results?

I think the gains would be perhaps marginal, as you'd still be suffering from a maintainer culture that produces un-ergonomic APIs backed by hard to read code with poor performance and recurring bugs. Good engineering goes well beyond choice of language, even if it is a very important part.