“It is the second statement in this tweet that is worthy of attention: the maintainers of log4j would have loved to remove this bad feature long ago, but could not because of the backwards compatibility promises they are held to.”
Log4j’s maintainers disliked the JNDI lookups that just set the internet on fire. They kept them for backwards compatibility. Compatibility is supposed to save users time, not preserve every dangerous feature. Pulling JNDI URLs would have broken a handful of builds. Keeping them broke everyone.