Has anyone implemented a public-key encryption scheme using a universal one-way function? There exists a function $f$ such that if one-way functions exist then $f$ is a one-way function.  Such a function is called a universal one-way function.
Now the public-key encryption schemes that I’ve come across use functions for which it is an open problem whether they are one-way functions even under the assumption that one-way functions exist.  My question is, has anyone implemented a public-key encryption scheme based on a universal one-way function?
If not, what makes a universal one-way function impractical to use?
We don't know of any construction of PKE based on a universal OWF. Actually, we do not even have any plausible candidate PKE that would be based on an arbitrary OWF. Obtaining such constructions is a major open problem. We know that there is no black-box construction of PKE from any OWF by a seminal result of Impagliazzo and Rudich. Of course, we cannot rule out all possible constructions: since we believe that both PKE and OWF exist, a valid construction of PKE from any OWF is: ignore the OWF and take a PKE which exists.
In any case, universal OWFs are too inefficient to be really useful in practice. Levin's initial construction is really, really super-duper inefficient. Levin also gave a more combinatorial construction based on tiling in this paper, but that would still be way to inefficient for any practical purpose (though perhaps &quot;implementable in theory&quot;, unlike his first candidate).
There are constructions of universal PKE (that are secure if any PKE exists), see for example the pointers in this paper, paragraph &quot;Brief history of combiners and universal cryptographic primitives&quot; in the introduction.

EDIT: answering the question in the comment
Universal cryptographic primitives are closely related to cryptographic combiners. A $(1,n)$-cryptographic combiner takes $n$ candidate cryptographic primitives, where one of them is guaranteed to be correct and secure (but we do not know which one), and produces a single combined correct and secure primitive.
Combiners and universal constructions have been formally studied in this work. The authors formally prove that the existence of a $(1,n)$-combiner for a primitive implies a universal construction of the primitive.
Then, their paper also provides a $(1,n)$-combiner for key agreement protocols; by their previous result, this implies a construction of universal key agreement. Furthermore, their construction is round-preserving: the final key agreement has the same round complexity as the candidate which had the highest round complexity in the combination.
This is actually more general than the result you are looking for, because a PKE is just a 2-round key agreement. Indeed, take a 2-round key agreement protocol between Alice and Bob, where Alice speaks first. Define the first flow of Alice to be the public key, and the secret state that she keeps to be the secret key. Given this first flow, Bob can compute his output, i.e., the shared key (since he will not receive any further message). An encryption of a message $m$ can then simply be defined as (second flow of the protocol, $K \oplus m$) (where $\oplus$ denotes the bitwise XOR): given the second flow and her secret state, Alice can recover $K$ (by the correctness of the key agreement), from which she can unmask $K \oplus m$ and retrieve $m$. Security of the encryption scheme follows from the unpredictability of the key in the KA protocol.
Furthermore, this is actually a 2-way equivalence: given a PKE, it is straightforward to build a 2-round KA protocol (I'll let you check it).
Summing up: there is a $(1,n)$-combiner for two-round key agreements (hence in particular for PKE) by the result of the work I pointed to above, where the result of the combination is still a 2 round KA. By their other result, this implies a universal construction of two-round key agreement. By the simple reduction I gave above (which is a standard exercise), this implies a universal PKE.