I'm not a PHP programmer so I can't assess the quality of the code myself but do we know objectively that OPNSense's PHP is better than pfSense? That seems like a big assumption that just because it's been rewritten it's more secure or "better"
While I haven't really done any hardcode PHP work after PHP5 came out, there are plenty of ways to do it wrong, and a few ways to do it right. One thing is separation of concerns and encapsulation to the point where a fault in PHP can only mess up the PHP part and not the external system PHP calls into to ask for configuration changes.
Currently, a lot of the old pfSense code has been removed and replaced with code in the MVC framework, but it's a lot of work, and the team behind open-source OPNSense isn't huge. It will take time to cover it all.