Are we really going to blame log4j2 authors who, for all we know, don't care if someone else is using their project?