I must confess to feeling that the reach of this CVE is a bit oversold. Yes, it's a terrible RCE and a major catastrophe for anyone using log4j. But log4j hasn't been the popular choice for logging implementations in a long time. Libraries typically use facades like slf4j or commons-logging, so the risk of pulling in an active log4j implementation transitively is pretty small. Your application/appserver either logs with log4j or not, and your developers are probably aware of this when they configured logging. You shouldn't need to pour over code to figure it out.
It would be far worse if this exploit existed in slf4j or commons-logging.
It would be far worse if this exploit existed in slf4j or commons-logging.