I don't know how folks would use a library as large as log4j rather than hassle looking at what is actually from the box, and whatever they need to empower/disable. Blaming it around the opensource product or service looks Odd once you grabbed it without spending a dime and failed https://prohactive.com