Sadly, this option is set to false by default in previous releases, that means that each one previous Log4j releases since 2.10.0, when this selection was added, are susceptible by default. Having the latter possibility is rather more handy, as it lessens the chance of losing important knowledge.