Bear with me; this is the history: wpa_supplicant is the program DragonFly uses to connect to most wireless networks. It’s been part of the base system for some time, but if you start it up, you will see a warning (at boot time) about how this version is deprecated. Installing from dports puts a newer version in place.
As is the case with most third-party include in any operating system’s base, there’s always lag between the newest version of software and what’s been included in. Dependencies creep in, or it’s duplicated work between packaging and basic OS maintenance, etc. (Who here used Perl on FreeBSD 4? That was frustrating, but a good example here.) Anyway, the dilemma is that since wpa_supplicant is a program that may be required in order to get online, it must be in the base install. However, since it has / had vulnerabilities, it must be updated. The base install doesn’t update as fast as the origin of the software, and there’s the mismatch.
All that’s a long explanation as to why network/wpa_supplicant is now on the DragonFly install CD, and gets automatically used if installed. Thanks for Aaron LI and Matthew Dillon for making it happen. The base package is still there, in case someone deletes their installed ports and needs to get online before they can reinstall. This is in master now and will be in the 5.4 release.