If developers think “log everything” means “log PII” then that developer is a liability regardless.

Also, this is the sort of thing that should get picked up in non-prod environments before it becomes a problem.

If you get to the point where logging is a risk then you’ve had other failures in processes.