>and a cultural bias towards simplicity, this is the tradeoff they decided to make
Literally the only point of an operating system is to be a stable API for other people to write software on top of. If you're not doing that, then why make an OS?
I don't think people are using PF to write software on top of -- they use OpenBSD specifically to run PF. You should look at upgrading OpenBSD in this use case to upgrading the firewall software.
It's a different case than mere "I compiled this application 6 months ago and I want to run it today", which is the "stable API" part of an OS that you mention.
Literally the only point of an operating system is to be a stable API for other people to write software on top of. If you're not doing that, then why make an OS?