I wholehearted agree that we, as an industry, need to sort out the issue of open source maintenance compensation, but out of all the projects that we could pick to make a stand, I can't think of a worse example. There's no need to support these hobbyists in particular, it's a logging library for Java that had no reason to be written, that fulfills no need, that no one forced them to write and makes the entire ecosystem worse by piggying back on the "log4j" fame. By the time log4j2 was released, slf4j + logback was already the spiritual successor to log4j 1, superior in all aspects, and maintained by someone who actually knows what they are doing.
log4j2 has no reason for existing, other than the hubris of their own authors, who, as the entire world just found out, are not qualified to write a logging library. sl4fj + logback is the saner (3rd party) logging interface. More logging interfaces make it harder for every JVM developer who need to keep track of them all, perform exclusions in their build system and then explicitly include an SLF4J bridge for whatever "logging interface du jour" the author of some other library that you actually want to use picked. So you can't really say the log4j2 authors are doing it "out of the goodness of their own heart", they're injecting unwanted garbage onto my dependencies because someone who wrote an actually useful library just wanted logging to work and bumped a log4j1 dependency to log4j2, usually because they're focused on writing a useful library that people want to use and are unaware logging in Java is a shitshow (can't blame them). Would you say that we should also be thankful of malware developers who are doing it for free?
The log4j2 team can whine about how they're being unfairly attacked when they're doing unpaid work, but the fact is that they wrote software that had no business existing and actively makes the life of everyone WORSE by simply existing. If they don't like it, they can do the honorable thing, put the project on security maintenance mode and and redirect everyone to slf4j + logback.