> You drop a file in your public web server folder and you’re done.
The implications of what this meant for security were very important too, but in a negative way. Instead of an application with a single or few small entry points (like CGI), you could just design your PHP app with a bunch of files spread across the exposed public directory structure, and for a long time this was the reigning paradigm for PHP.
This, combined with the extension controlling whether it was processed as a PHP script or a plain text file meant that anyone making a quick and dirty backup of a file they were changing that didn't consider this would often end up exposing files to the public they didn't intend (mv config.php config.php.bak).
Additionally, since most people were running on shared hosting platforms and PHP was usually run as the webserver user, and many applications were designed to be dropped entirely into a public web structure, any capability for writing locally (like allowing file uploads) often consisted of setting a directory world writable to drop files in. Even ignoring how often people screwed up setting permissions and set everything of theirs world writable, even when done correct this usually ended up being security through not-so-obscurity, since common apps had default locations they used more often than not (customizing that required more user interaction and knowledge to set up, which was against the ethos of "drop in and use" PHP heavily leaned on initially).
PHP's ease of use was the ease of use of Windows 95 compared to Windows NT or Windows 2000. Sure, things are easier when you don't have to care about users and permissions and security. But you need to bootstrap any success you have into fixing those problems ASAP.
PHP was always a victim of it's own success in this regard. The thing that made it easy to use for people was that it did away with a lot of the security concerns that were (barely) in place at that time, and the effects of that are what made it a nightmare for those managing it, and often at one point or another those using it as they were bitten by these problems.
I'm glad we've all moved on from that. PHP did a lot to make it easier for people to do stuff online, and that in itself is a good thing and a laudable achievement. I'm unsure if it was a net gain though. It's too complex for me to easily say it was one, nor that it was definitively a net loss.