OPNSense replaced a lot of the old PHP that was in pfSense after it forked. So if PHP is a concern for you, you could argue that's OPNSense's PHP is better than pfSense's PHP.

OPNSense also splits front-end into the MVC and control layer, as well as the back-end between the control layer and the configuration daemon which is written in python.

All of the actual packet processing and daemons are C or C++, essentially the standard packages you'd find in FreeBSD.

Whether PHP or C is more secure depends on who wrote it.