This isn't about systemd. OpenSSH is one of the most (if not the most) security-critical program in the distribution. Many systems run with just ssh enabled. That's why you don't mess with it.
Which library pulled the vulnerability in is mostly irrelevant.
Which library pulled the vulnerability in is mostly irrelevant.