The FOSS label is an extremely powerful statement and draws in lots of users. To switch the license is very poor taste in my opinion, and not much different from a bait-and-switch.
It should be a maintainers responsibility to be very clear about their goals for this project. I feel that they jumped the full-time gun too quickly, and now users will be paying for it
But it's not a bait and switch because we don't have a right to his future work under whatever license we like. Imagine the developer was hit by a bus right now, or became a cloistered monk. Same difference.
If he takes people's donation money with the implicit or explicit promise that he's going to make a good-faith effort to continue working on the code, he has a moral obligation to do that IMO. Getting hit by a bus wouldn't be his fault, but choosing to abandon it to become a monk would be.
In the absence of clear language I think it's unreasonable to expect a small amount of money to create an infinite obligation.
I'd expect a donation to be spent on development expenses, including time. I'd expect the developer to continue developing until the money runs out, or return the remaining money.
Imagine you have GitHub sponsorships providing $2,000/month. You use that money to cover all your expenses and work on OSS full time. Everyone stops donating today. Surely you'd get a job and stop working on OSS full time?
If commercial entities can do it, so can the FOSS community.
Your example shows the opposite of what you intended to show. It was the people stuck at a particular version of log4j (the old unsupported log4j 1.x branch) who avoided the vulnerability, while the ones who kept up-to-date with the maintained log4j 2.x branch were vulnerable. And it also shows the power of a permissive license: for those stuck at the older log4j 1.x branch, which had been abandoned by its maintainers, there's now a fork by someone else (https://reload4j.qos.ch/) which is being maintained.