I think people are assuming he wrote a pile of hot PHP garbage, but it's entirely possible he just wrote it using Symfony or Drupal and well understood PHP libs and just has no 'modern javascript' to do it, which if he did would cover all of your points. If you haven't gone back to current gen PHP in a while there are some quite solid models that are very maintainable, have security updates (via composer) and so on. It's entirely possible that he didn't do a crazy thing but we'll never know.

A decently structured PHP application is often maintained by nontechnical people with a limited understanding of programming but they can get by with just a text editor and a codebase. I have not come across any nontechnical person who could easily get a react/modern js framework pipeline going to do a small change, not to mention dealing with npm changes. I would almost feel like it would be a jerk move to leave someone without a technical department a pile of react/npm soup right now.