This was by design. Java has a history of these kinds of wild exploits ever since the XML days.

The original use case was probably something like: we want to be able to customise the logging on a per user/customer basis, so if we can make a call to our LDAP server, we can return a Java class that will implement that customisation.

This is enterprise level thinking.

Some history from cloudflare here: https://blog.cloudflare.com/inside-the-log4j2-vulnerability-...