> Personally I wonder whether anyone actually used log4j willingly

Any project written in Java that has ANY dependencies will also use Log4j. Not even your choice anymore unless you are willing to write your entire stack from scratch.

The moment you start thinking about how to solve logging you will land at a log4j-like framework anyway.

> You should be checking all your 3rd party source code

How is that a usable advice? There are dozens of dependencies in a simplest application. A non-trivial may easily have above hundred dependencies.