But what TYPE of happy are you?

Today I was tasked to audit our system for uses of log4j and I was so relieved to learn all our services are written in Go or PHP.

Also noticed we were continously scanned for the vulnerability (random "jndi:ldap" in requests) from different IPs, some from China

There's nothing about Python that actually stops this kind of attack. It just happens to be Java this time around. But providing expansive evaluation of variables is definitely something Python should be concerned about. This would be a good time to check if poor patterns around logging and having untrusted strings in trusted contexts exists in your code base, no matter the language.