Log4Shell wouldn't have happened in Rust because no widely used Rust serialization library is designed to call arbitrary code at deserialization time.