Depends on what you are doing. We mask auth stuff and some known params like an auth header might log as "authorization: bearer $APIKEY". Some things can't be logged. But as a general rule, it is an immense time saver.

Yeah, structured logging has a tendency to do that as well.

Logs are often a treasure trove for system invaders.