Yes, rcl is composing multiple output handlers into a single handler that it registers with rcutils (see: https://github.com/ros2/rcl/blob/master/rcl/src/rcl/logging.c#L127-L139 and https://github.com/ros2/rcl/blob/master/rcl/src/rcl/logging.c#L103). If you just want to disable the spdlog handler then you could use g_rcl_logging_ext_lib_enabled, which gets set based on parameters when you run your ROS application.
If you want to go the route of modifying rcl_logging_spdlog to register a syslog sink instead or in addition to the file sink you could definitely do that. The external logging library is statically linked when rcl is compiled, but I believe that the rcl library is dynamically linked during runtime. That should mean that you only need to recompile rcl_logging_spdlog and rcl and make sure they’re sourced as an overlay to the base ROS install. During development I was recompiling only rcl, rclcpp, and rclpy with the modified loggers and my test application was working correctly. I haven’t tested only recompiling rcl and not the cpp/python client libraries as well, but I think it should work.
Your other option right now if you absolutely don’t want to recompile rcl would be to override the base output handler that rcutils uses for all loggers. All of the individual log out handlers (rosout, stdout, and ext_lib) should all be publicly available in the libraries so you can write your own composition function with your own custom spdlog handler and register it in your application (see how rcl registers it here: https://github.com/ros2/rcl/blob/master/rcl/src/rcl/logging.c#L103). The drawback to this approach is that you’ll have to have every ROS application that runs explicitly do this.
If you want to think beyond the Eloquent release, you could always contribute additional functionality to the ROS codebase to make the rcl_logging_spdlog library configurable at runtime or make the external logging library dynamically loaded during runtime instead of during compile. Both of those features were discussed but ultimate cut from initial implementation due to time constraints.