You see a similar problem with obsolete computers, operating systems, phones, routers, etc. People keep them connected to the Internet even though they have known vulnerabilities. People who do this will even claim they have not been hacked.
Thankfully the wheels are already set in motion.
We'll have to allow open-source code to waive liability, but not allow companies to waive liability; that's tricky and will go against the interest of the rich and powerful, so it will be especially hard to navigate.
Or maybe someone had to run some scanning tool which reported 'no vulnerabilities'.
Exploiting log4j requires logging to be influenced by user input. Even if an application includes a vulnerable log4j but doesn't bother to log anything there's zero risk. In that case apathy saved you ;)
Time to find a new vendor, as your continued usage of their unsecured services is now a liability.
