The issue - obfuscated code in third-party templates - is hardly inherent in PHP. The same technique can be used in any other popular web language.
For example: http://api.rubyonrails.org/classes/ActiveSupport/Base64.html
For example: http://api.rubyonrails.org/classes/ActiveSupport/Base64.html
Yes, it's possible to do, but much harder than eval'ing a string in the resource file.
The examples from this article are all essentially malicious third-party code. No language will save you from that.
None of these suggestions are worth a damn until the WordPress team acknowledges that WordPress security is a major problem, one that should be a top priority for them.