They didn’t know it was vulnerable, they just didn’t like it for other reasons.
Should maintainers of all core apache libs just remove or disable features they don’t like, when not known to be insecure?
That said, log4j2 isn’t that old. Not sure why this was added in the first place. At the very least it’s a performance issue.