There's no way to argue that less than zero funding would have prevented the log4j maintainers from merging a patch that was sent to them by a third party.