It's used all the time in logging. The nature of this also means it's more likely than critical code to end up not doing what you expect, right up until you need to look at logs to debug a live issue. String interpolation is just vastly superior at this compared to format strings.
Format strings also have a history* of crashing or worse and have historically been a very legitimate security concern by themselves. At least Go didn't inherit that.
*Well, still-present if you still use the bad functions in C or C++.