Yes it's true that proper config can make this problem go away, but the fact that some of the advantages of PHP such as ease of deployment (drop a .php file -> you have a webapp) is a double-edged sword as it encourages a lot of bad practices (that large legacy projects such as Wordpress continue promoting).

It's indeed possible (and quite pleasant) to do proper PHP with a good framework, sane web server config & modern development practices. The problem is that a sizeable chunk of the PHP ecosystem (and very popular projects such as Wordpress) are not doing that.