That's my take on it from reading so far. That's a massive mitigating factor for exploitation, imo. Log4Shell was painful because people were using the library

That's my take on it from reading so far. That's a massive mitigating factor for exploitation, imo. Log4Shell was painful because people were using the library as it was intended to be used (a logger takes strings that are possibly attacked controllable). This will not be as bad simply because it won't be easily exploitable to the same degree.