“Just because you outsource your block cipher implementations to your programming language’s crypto module doesn’t mean you’re not rolling your own crypto.”
A startup co-CEO shipped unauthenticated AES-CBC and said it was not rolling his own crypto because Node’s crypto module did the math. It was open to a padding oracle attack from 1998. The libraries stay low level and nobody ships a protocol developers can drop in. So developers keep inventing one.