I can't help but to wonder. How can we ever tell that this kind of vulnerability in open source library is accident of feature creep or simply incompetnence ?

I can't help but to wonder. How can we ever tell that this kind of vulnerability in open source library is accident of feature creep or simply incompetnence ? What if this is a deliberate backdoor introduced by third party? I bet there are a lot of groups out there that would give leg and arm for having knowledge of this vulnerability for years it was out there in log4j.