Exactly. If we paid people to maintain log4j, they'd try to justify their existence by writing more code and shipping it in log4j. But log4j doesn't need more code to be secure, it needs dramatically LESS code!

The correct answer here isn't "pay people to make log4j even worse", it's "don't use log4j".