I specifically said "large PHP applications" instead of just "PHP applications" because the difficulty is not in writing, it's in auditing and enforcing.

Even within templating libraries there are different levels of advancement around context-awareness: e.g. <div onclick="{{ val }}"> is still dangerous in languages like Twig, and is similarly challenging to audit. Alternatives like Latte mitigate this but even Twig is still a large degree easier to work with than vanilla PHP.