OpenSSL updates, in my experience, go nearly effortlessly. I have a BigFix sandbox, and I just apply the fixlet once it comes in, and my systems get updated. And I leave the fixlet "open" so that whenever I re/install a VM openssl is updated magically.
OpenSSH can be an issue, especially if you change release levels as the defaults, or even names (of options or option settings) change from release level to release level - which is why, I suspect, AIX was at release 6.0 of openssh for forever.
In case you had not noticed, I also package OpenSSH - and I do so in a way that the AIX one is still installed, just not the default. And, should you decide to uninstall mine, it restores the AIX one as default. FYI: I also have the openssh-8.0 packaged (although I should check for a later 8.X version) - as long as you are testing.
***
In a different area - should actually start a new thread, so I shall, but mention it here - I am researching what is needed to have AIX wheels for Python modules. I have already found that it can work - there are just some details that need to be addressed to make it much better.