Comment by cesarb

> I wonder how 3&4 avoided it :)

Probably the same way log4j 1.x avoided log4shell: the vulnerable code was introduced on a later release.