Most every company I've worked for, large and small, has paid for professional third party security audits that scrutinize the dependency chain. log4j still was

Most every company I've worked for, large and small, has paid for professional third party security audits that scrutinize the dependency chain. log4j still wasn't flagged as problematic.