Well the fact that you need to 'choose' a cryptographic protocol out of the suite of ciphers reminds me of why the creator of WireGuard opted for no cryptographic agility and instead chose versioned protocols, unlike OpenVPN.
From the Wireguard paper [0]:
> 'Finally, WireGuard is cryptographically opinionated. It intentionally lacks cipher and protocol agility. If holes are found in the underlying primitives, all endpoints will be required to update. As shown by the continuing torrent of SSL/TLS vulnerabilities, cipher agility increases complexity monumentally.'
From the Wireguard paper [0]:
> 'Finally, WireGuard is cryptographically opinionated. It intentionally lacks cipher and protocol agility. If holes are found in the underlying primitives, all endpoints will be required to update. As shown by the continuing torrent of SSL/TLS vulnerabilities, cipher agility increases complexity monumentally.'
[0] https://www.wireguard.com/papers/wireguard.pdf