EVP_BytesToKey
OpenSSL's legacy function for turning a password into a key and IV — fast, simple, and unsuitable for exactly those reasons.
It hashes the password and salt, then hashes the previous output plus password and salt again, and concatenates blocks until there is enough for both a key and an initialization vector. openssl enc used it with a single iteration, and until OpenSSL 1.1.0 (2016) the hash was MD5. The output file starts with the string Salted__ followed by eight bytes of salt, which makes such files easy to recognise in the wild.
One iteration means an attacker with a GPU can try billions of passwords a second. OpenSSL 1.1.1 added the -pbkdf2 and -iter flags in 2018 and started warning about "deprecated key derivation". The format lives on regardless — notably in the JavaScript library CryptoJS — because nobody wants to break compatibility with data that's already encrypted.