It is indeed passed to all modules, I expected that it was passed to the core only and the modules that needed had it in their Makefiles.
Now I wonder if that is actually needed for all (or most) modules, that can indirectly link to libssl somehow. I cheked with 5.8 and -thread is given there as well, so it can stay like it is, for all.