Was it actually though? I worked at an MSP at the time and our tools were just flagging the mere existence of the library. It either wasn't being used or wasn't exposed in any meaningful way. Oh a dev happens to have it installed on his laptop? Who cares.

I remember our infosec person instructing us to verify we don't use log4j in our system written in PHP. Well, we didn't :)