I'm sure the log4j developers have just as much potential as the code they're sort of maintaining.

If you let them into your codebase you get federated remote code updates for free.