Many of my affiliate based site don't use any frameworks. Just a couple of php lines to get the data and voila. It really depends of your needs. In this case, there is not even security needs...! Why bother?
Are you setting your Apache configuration to only allow reading certain directories?
Disabling shell functions (system, exec, etc.) is also a good idea, unless the application itself requires them (e.g. if the host is too stupid/lazy to have the imagick extension installed and tells you to call /usr/bin/imagick instead...).