DragonFly ships with wpa_supplicant, for setting up WiFi. However, there’s no guarantee it’s the latest version. A solution exists: security/wpa_supplicant in dports. However, this has a chicken-and-egg problem, where you need wpa_supplicant to get online and download the dports version of wpa_supplicant. So, DragonFly still includes wpa_supplicant in the base system, but you should upgrade to the dports version when possible.
A running description of activity related to DragonFly BSD.
I think it would be better to provide wpa_supplicant as pre-installed package built from dports i.e. in a way as git and bind-tools are provided.
Update: and so wpa_supplicant could be removed from source tree.
Maybe an installer menu item “Install security updates with pkg” for this and future similar issues.