When every tech news site puts the vulnerability in headlines, it's going to have a lot of visibility and many of Cloudflare's customers are going to ask them about it (regardless of whether the attention is warranted or not).

That still doesn't stop people from asking about log4j way over a year after the entire fiasco went down...

> I figured the default assumption was these vendors kept updated with security patches.

That's a damn big assume when you have compliance to worry about.