In cases like this I think it's usually a collection of changes that result in the vulnerability. Someone adds support for format strings in a config. Then late

In cases like this I think it's usually a collection of changes that result in the vulnerability. Someone adds support for format strings in a config. Then later someone else says "hey, what if we expanded format string support so that they can be interpolated in log strings" and at that time this didn't present a risk since the strings didn't support commands. Then someone else says "wow, what if we added support for commands to our format strings", not realizing that they now are also interpolated in log strings. I'm not saying this is exactly what happened, but I've seen it often enough.