The risk for a denial of service by a malicious programmer are much lower than the DOS risk posed by a distracted programmer. Looking at the typical attack surf

The risk for a denial of service by a malicious programmer are much lower than the DOS risk posed by a distracted programmer. Looking at the typical attack surface in an enterprise app a distracted programer can stumble on to trigger a DOS the risk of stumbling on the log4j recursion by accident is minuscule.