Uh, the place I work isn't run like this. I guess it must be different for a social media company since they don't really provide a serious product that their customers depend on. My employer couldn't ignore the log4j vulnerability because our customers were all over that shit and demanding to know what we were doing to eliminate that vulnerability from the code we delivered to them.