I think this would have solved the log4j vulnerability, no? As I understand it, log4j allowed malicious ${} expansion in any string passed to logging functions

I think this would have solved the log4j vulnerability, no? As I understand it, log4j allowed malicious ${} expansion in any string passed to logging functions. So logging user generated code at all would be a security hole. But Python's t-strings purposely _do not_ expand user code, they only expand the string literal.