Dependency in effective pom but not in dependency tree, is it being used?

I saw other similar questions but none of them had the answer I was looking for.

My question is related to the Log4j2 vulnerability recently.

I have a Maven Spring boot project where I did not switch the default logging system to Log4j2. When I run mvn dependency:tree I only see the log4j-to-slf4j jar and log4j-api jar but not the log4j-core jar, so according to https://spring.io/blog/2021/12/10/log4j2-vulnerability-and-spring-boot I assume my app is not affected.

But when i generate the effective POM I see the following

<dependency>
  <groupId>org.apache.logging.log4j</groupId>
  <artifactId>log4j-core<artifactId>
  <version>2.14.0</version>
</dependency>

I see many other dependencies in the effective POM like log4j-couchdb which the app is definitely not using (the app is not using database), so my thinking is a dependency that is in effective POM does not mean it is packaged to the app jar and used?

When I read up on definitions of effective POM, I got the feeling that whatever is in effective POM is being packaged and used by the app, so I am confused. Hope someone can help me on this. Thanks!