Why still VMWare still uses the old OpenSSL 1.1.1 and even an old version 1.1.1q?

It is an open source project, literary just download the source and compile.

There is a newer version 1.1.1t and many versions were released where there have been many CVE fixes!

Why not using the new version 3.1?

Tested with version 17.02