The log4j exploit was based on remote class loading, not serialization... though if your JVM protected you against remote class loading, it's indeed correct tha

The log4j exploit was based on remote class loading, not serialization... though if your JVM protected you against remote class loading, it's indeed correct that one way to bypass that protection was by using a serialization attack.