As OpenBSD documentation clearly states it in bold red characters in their introduction about ports:
The packages and ports collection does NOT go through the same
thorough security audit that is performed on the OpenBSD base system.
Although we strive to keep the quality of the packages collection
high, we just do not have enough human resources to ensure the same
level of robustness and security. Of course security updates for
various applications are committed to the ports tree as soon as
possible, and corresponding package security updates are made
available as snapshots for -current.
This means a few things:
- OpenBSD security claims is only valid as long as the base system is concerned.
- Security updates for the third-party packages will only be applied on the package source code from the ports tree and the -current branch. They will not be available for binary packages, even-though binary packages is the officially recommended way to go to install third-party software.
- It also mentions a lack of resources which also explains why the software version available for OpenBSD may be outdated, which can have security impact for the end-user.
With all this in mind, the security posture of the OpenBSD OS regarding third-party software is quite bad. Hopefully, a third-party commercial company (M:Tier) provide its own update channel for OpenBSD users to make things a bit better.
OpenBSD goal is to promote clean and sane coding measure and a "Secure by default" OS. While installing third-party package remains possible, this may affect this goal and should be done with a clear understanding of the consequences on the overall system security.