Failing to build lzma due to format-security even though it's disabled

I'm on commit 221fbfa2d854ccb6cd003c065ec308fbc0651b11 (HEAD -> 22.0.3, tag: v22.03.3) . Running make tools/lzma/compile -j1 V=s gives me the following error (I've pulled out what I think are the relevant parts).

make -C /home/austin/Documents/openwrt/build_dir/host/lzma-4.65/C/LzmaUtil -f makefile.gcc
make[3]: Entering directory '/home/austin/Documents/openwrt/build_dir/host/lzma-4.65/C/LzmaUtil'
gcc -c -O2 -Wall LzmaUtil.c
LzmaUtil.c: In function 'Decode2':
LzmaUtil.c:95:39: warning: suggest parentheses around '&&' within '||' [-Wparentheses]
   95 |       if (res != SZ_OK || thereIsSize && unpackSize == 0)
      |                           ~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~
LzmaUtil.c: In function 'main':
LzmaUtil.c:252:10: error: format not a string literal and no format arguments [-Werror=format-security]
  252 |   printf(rs);
      |          ^~
cc1: some warnings being treated as errors
make[3]: *** [makefile.gcc:24: LzmaUtil.o] Error 1

Despite the fact that in my .config file I've disabled FORMAT_SECURITY.

openwrt-fhs-chrootenv:austin@austin-work:~/Documents/openwrt$ rg FORMAT_SECURITY .config
374:# CONFIG_PKG_CHECK_FORMAT_SECURITY is not set

What's even stranger is that yesterday I had this problem, found what I thought was the solution (disabling format-security), and had a fully successful image build. But I wanted to make sure my steps were repeatable so I started over (distclean, copied over the .config), and I've hit the same issue again.

Anyone else having a similar issue? What am I doing wrong? Keep in mind I didn't know how to compile OpenWRT at all until 2-3 days ago.

I should note I also tried adding PKG_CHECK_FORMAT_SECURITY:=0 to tools/lzma/Makefile, same issue.

@K900 I see on GitHub you've mentioned this issue, any ideas?