"there were no servlets (or resources) registered against paths that included the path traversal within them. [..] We were incredibly annoyed by this"

That's a funny perspective from a hacker. From the other side I'd be incredibly annoyed if my application server was legitimately resolving path directions like "..%2F". That's the kind of "feature" that's been responsible for some of the worst compromises recently. I'd include both *sshole and log4j in that category.