As ever I enjoyed this show and broadly agree with many of your points. I would first like to strongly disagree with the section where you discuss LibReSSL before adding another suggestion.

Your Ad hominem argument against Theo de Raadt (10:23:00) was unmerited, and while people may criticise his tact, he has a long history of producing and managing secure projects.
From https://en.wikipedia.org/wiki/Theo_de_Raadt: "He is the founder and leader of the OpenBSD and OpenSSH projects". 

To address your other points in that section.
1. "I would stick with OpenSSL and give LibReSSL a pass, at least until such a time as they show a long track record of success".
The developers of LibReSSL have a long track record of success as they are the same people that bring you OpenSSH. They are noted for been able to produce secure software. So much so that Linux Torvalds said of the team, "I think the OpenBSD crowd is a bunch of masturbating monkeys, in that they make such a big deal about concentrating on security to the point where they pretty much admit that nothing else matters to them." From a practical point of view everyone running any Linux Distribution is more than likely already running and trusting OpenSSH.
From https://www.libressl.org/: "LibReSSL is primarily developed by the OpenBSD Project". 
From https://www.openssh.com/: OpenSSH is developed by the OpenBSD Project.

2. "A good general rule in security is that new code is much more dangerous than code that has been around for a long time"
The whole heart bleed issue proves this to be false. The rule itself is based on the premise that if it's around a long time, many people have reviewed the code and many bugs have been fixed. This is a rewording of "given enough eyeballs, all bugs are shallow", Linus's_Law argument which you yourself criticise in the episode. 
https://en.wikipedia.org/wiki/Linus's_Law 

Many people skip the caveats in the formal version "Given a large enough beta-tester and co-developer base, almost every problem will be characterized quickly and the fix will be obvious to someone". The heart bleed code was caused by not having a large enough beta-tester and co-developer base, and yet this is exactly what the OpenBSD Project brings to the table.

Furthermore LibReSSL is not "new code", but rather it is "forked code". They are fixing old existing bugs on OpenSSL and nothing is preventing OpenSSL from implementing the fixes they discover.

3. Your argue that removing code and "stuff they don't care about" doesn't look good.
I would point out that that is not a bad thing and was widely supported when LibreOffice forked OpenOffice. Michael Meeks celebrates this by publicising 38,714 known unused methods in LibreOffice. "One of the unfortunate things that LibreOffice inherited, as part of the several decades worth of unpaid technical debt, is unused code that has been left lying around indefinitely. This was particularly unhelpful when mingled with the weight and depth of the useful code we have around the place."
From https://people.gnome.org/~michael/blog/2012-01-09-unused.html 

So finally I would suggest that "Mono Culture is bad" should be added to your list. Having (cooperating) competing systems, is not a bad thing as it encourages development, and innovation. Over reliance on any one piece of software is a bad thing. We saw that in the fields of Operating systems, web browsers and now in Security Libraries. 