“Short answer: the code is not reachable by the current corpus and harness.”
OpenSSL runs on OSS-Fuzz, and everyone assumed that covered it. The punycode bug sat behind certificate chain verification that the fuzz harness never reached, with zero coverage on the file that mattered. Fuzzing only tests the code you point it at. A green dashboard told nobody that.